-
April 5th, 2012, 05:56 AM
#1
IDA pro and Ollydbg addresses confusion
So I open this program with Ida and there is this string "security option" which is kind of like "License not found" ... so what I do is to double click on it and go to the IDA-View A and see the address which is:
.rdata:0057F5C4 aSecurityOption db 'Security Options',0 ; DATA XREF: sub_4E5830+2Co
In the next step I go to the Olly and look for 0057F5C4 but the last address is 00567FFF
Also I cannot find this "security option" string anywhere in Olly!!!!!!!!!
So my question is that what is wrong here? Why do I not have the same address in Olly?
I have other questions as well but I'd rather leave them for another time after I find out the answer to this one
THank you so much
-
April 7th, 2012, 05:51 PM
#2
I know that different decompilers/disassemblers use different algorithms to come up with the code that you see, so your code might look a little different in different debuggers. However, strings are strings, and should be seen in any software that you use. That is quite strange.
-
April 8th, 2012, 03:25 AM
#3
Do an actual "string search"... but make sure you're in the main module in ollydbg. Then you want to lookup pointers to that string.
You'll see it push the address of the string to a register then call the api. You'll want to scroll up a little and loopup any jumps to the api.
Those should be your "if its not registered then display this" type of arguments.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|