Results 1 to 3 of 3

Thread: IDA pro and Ollydbg addresses confusion

  1. #1
    Senior Member
    Join Date
    Jul 2008

    IDA pro and Ollydbg addresses confusion

    So I open this program with Ida and there is this string "security option" which is kind of like "License not found" ... so what I do is to double click on it and go to the IDA-View A and see the address which is:

    .rdata:0057F5C4 aSecurityOption db 'Security Options',0 ; DATA XREF: sub_4E5830+2Co

    In the next step I go to the Olly and look for 0057F5C4 but the last address is 00567FFF

    Also I cannot find this "security option" string anywhere in Olly!!!!!!!!!
    So my question is that what is wrong here? Why do I not have the same address in Olly?

    I have other questions as well but I'd rather leave them for another time after I find out the answer to this one

    THank you so much

  2. #2
    Senior Member
    Join Date
    Apr 2005
    I know that different decompilers/disassemblers use different algorithms to come up with the code that you see, so your code might look a little different in different debuggers. However, strings are strings, and should be seen in any software that you use. That is quite strange.

  3. #3
    Join Date
    Feb 2012
    Do an actual "string search"... but make sure you're in the main module in ollydbg. Then you want to lookup pointers to that string.

    You'll see it push the address of the string to a register then call the api. You'll want to scroll up a little and loopup any jumps to the api.

    Those should be your "if its not registered then display this" type of arguments.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts