WebRIPPER
February 23rd, 2004, 12:15
Bug, or doing something wrong...
The same test program, with Olly and W32Dasm
Following {Olly} :
--------------------------
0042F35B . 50 PUSH EAX
0042F35C . 68 1B270000 PUSH 271B
0042F361 . E8 3AF40100 CALL hb3.0044E7A0
0042F366 . 83C4 04 ADD ESP,4
0042F369 . 50 PUSH EAX ; |Text
0042F36A . 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ; |
0042F36D . 50 PUSH EAX ; |hOwner
0042F36E . FF15 6C044600 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
--------------------------------------------
Following {W32Dasm} :
--------------------------
:0042F35B 50 push eax 0
* Possible Reference to String Resource ID=10011: "Test for UNICODE key as reference"
|
:0042F35C 681B270000 push 0000271B
:0042F361 E83AF40100 call 0044E7A0
:0042F366 83C404 add esp, 00000004
:0042F369 50 push eax 0
:0042F36A 8B4608 mov eax, dword ptr [esi+08] re
:0042F36D 50 push eax d
* Reference To: USER32.MessageBoxA, Ord:01BEh 11
|
-----------------------------------
As you can see W32Dasm detect the string, but Olly does not. How make Olly able to detect unicode referenced strings?
The same test program, with Olly and W32Dasm
Following {Olly} :
--------------------------
0042F35B . 50 PUSH EAX
0042F35C . 68 1B270000 PUSH 271B
0042F361 . E8 3AF40100 CALL hb3.0044E7A0
0042F366 . 83C4 04 ADD ESP,4
0042F369 . 50 PUSH EAX ; |Text
0042F36A . 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ; |
0042F36D . 50 PUSH EAX ; |hOwner
0042F36E . FF15 6C044600 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxA
--------------------------------------------
Following {W32Dasm} :
--------------------------
:0042F35B 50 push eax 0
* Possible Reference to String Resource ID=10011: "Test for UNICODE key as reference"
|
:0042F35C 681B270000 push 0000271B
:0042F361 E83AF40100 call 0044E7A0
:0042F366 83C404 add esp, 00000004
:0042F369 50 push eax 0
:0042F36A 8B4608 mov eax, dword ptr [esi+08] re
:0042F36D 50 push eax d
* Reference To: USER32.MessageBoxA, Ord:01BEh 11
|
-----------------------------------
As you can see W32Dasm detect the string, but Olly does not. How make Olly able to detect unicode referenced strings?