PDA

View Full Version : Olly and W32Dasm


Surreptitious
October 2nd, 2006, 17:23
How can I see some strings in W32Dasm and not in Olly? Thanks...

Ricardo Narvaja
October 2nd, 2006, 17:28
n olly you can configure the section for view the strings, in debugging options- debug, put the mark in search for references in: memory code selected in dissasembler, with this olly show the strings of the section you are looking in the CPU window, can be a dll, a section of the exe, you choose.

in the E window, you can right click, and choose view resource strings and see more strings.

Ricardo

Surreptitious
October 2nd, 2006, 17:46
Many thanks Ricardo, this is great help

Surreptitious
October 3rd, 2006, 12:58
Ok, here's another issue that I encountered: I'm not able to see the string reference in Olly but I can see it with W32Dasm. I tried this time what you told me above but it didn't work. More, at the address indicated in W32Asm where the reference is, Olly shows no strings at all. Why? Thank you.

Ricardo Narvaja
October 4th, 2006, 04:27
do you look in the dump window, in this address, in asc mode?
olly show more strings if you go to view-executables, ahd right click - view resource strings.

look this

ricardo

Surreptitious
October 4th, 2006, 07:50
Great, I got the string I was looking for with view executables, right clicking then view string references. Now, this is the first time I'm doing this, and I can't understand the address on the left side: 005FC3D6 which is greater than the last address in the exe file which is:

005416DF .^E9 22E0FBFF JMP bcp.004FF706

Is there a way to reach 005FC3D6? Thank you again Ricardo

Ricardo Narvaja
October 4th, 2006, 17:14
goto expression=5FC3D6 if don愒 show there are a error

Ricardo

Surreptitious
October 5th, 2006, 09:26
I finally and successfully finished what I was working on. I still have a question. Can we upload tutorials on this forum? Thank you

naides
October 5th, 2006, 10:22
Quote:
[Originally Posted by Surreptitious]I finally and successfully finished what I was working on. I still have a question. Can we upload tutorials on this forum? Thank you



That is an interesting question:

Most tutorials do contain explicit references to commercial applications and/or identifiable code snippets, which give legal ammunition to those people and entities that would like to see this forum closed.
So it does not sound like a great idea at first sight.

There are plenty of tut repositories, some of them linked in here, where people can submit their work. . .

artemis
November 17th, 2006, 04:09
Hi~everybody~
first ~ I must to say sorry~
because my english very bad~

But I have a Q~
I want to establish the IAT database~
but the IAT table can auto to transfer the .txt file?
thank you