Problem with referenced strings in Olly.

[Newbie_Cracker]

mscvr80.dll and mscvp80.dll is needed to run v8.0 file (as I don't have VC 8.0).

But OllyDbg has no problem with v6.0 strings.

Text strings referenced in MSVC_6_0:.text
Address    Disassembly                                 Text string
0040100C   MOV ESI,MSVC_6_0.0040D0C0                   ASCII "Hit any key to continue"
00401020   PUSH MSVC_6_0.0040D0A8                      ASCII ""This will be gone"
"
00401040   PUSH MSVC_6_0.0040D0A0                      ASCII "PAUSE"
00402577   MOV ESI,MSVC_6_0.0040B1BC                   ASCII "ios::badbit set"
00402581   MOV ESI,MSVC_6_0.0040B1A8                   ASCII "ios::failbit set"
00402588   MOV ESI,MSVC_6_0.0040B198                   ASCII "ios::eofbit set"
004039C9   MOV ESI,MSVC_6_0.0040B2B0                   ASCII "string too long"
00403BF5   MOV ESI,MSVC_6_0.0040B2E0                   ASCII "invalid string position"
00403E5B   PUSH MSVC_6_0.0040B314                      ASCII "COMSPEC"
00403E8C   MOV DWORD PTR SS:[EBP-C],MSVC_6_0.0040B310  ASCII "/c"
00403EC6   MOV DWORD PTR SS:[EBP-10],MSVC_6_0.0040B30  ASCII "command.com"
00403ECF   MOV DWORD PTR SS:[EBP-10],MSVC_6_0.0040B2F  ASCII "cmd.exe"
0040436C   PUSH EBP                                    (Initial CPU selection)
00405239   MOV EAX,MSVC_6_0.0040B340                   ASCII "Unknown exception"
00405776   PUSH MSVC_6_0.0040B37C                      ASCII "PATH"
004058E2   PUSH MSVC_6_0.0040B3A4                      ASCII ".\"
00406EDE   PUSH MSVC_6_0.0040B6F8                      ASCII "<program name unknown>"
00406F20   PUSH MSVC_6_0.0040B6F4                      ASCII "..."
00406F34   PUSH MSVC_6_0.0040B6D8                      ASCII "Runtime Error!

Program: "
00406F52   PUSH MSVC_6_0.0040B6D4                      ASCII "

"
00406F7A   PUSH MSVC_6_0.0040B6AC                      ASCII "Microsoft Visual C++ Runtime Library"
00407B76   ASCII "h0{@",0
004094B8   PUSH MSVC_6_0.0040B740                      ASCII "user32.dll"
004094CF   PUSH MSVC_6_0.0040B734                      ASCII "MessageBoxA"
004094E0   PUSH MSVC_6_0.0040B724                      ASCII "GetActiveWindow"
004094E8   PUSH MSVC_6_0.0040B710                      ASCII "GetLastActivePopup"

Maybe your debugger is f*cked up !

Originally Posted by newbie_cracker

mscvr80.dll and mscvp80.dll is needed to run v8.0 file (as I don't have VC 8.0).

But OllyDbg has no problem with v6.0 strings.
...

Maybe your debugger is f*cked up !

If you need those 2 files for running VC 8.0 files just say and I'll give them to you, Olly seems fine because it opens VC 6.0, just like yours did. But it couldn't find the strings with the 8.0 file. But the person below answers that.

Originally Posted by TQN

No, not a bug of OllyDbg. VC++ 8 optimize code by breaking the string "Hit any key to continue" to an array of dword, and move every dword to local buffer, work with this local buffer. It not directly access to the address of char done[100] in the readonly section (rdata).

...

Regards,

Thank you for the information. Is there a way of being able to kind of "search" for this as a string though, some kind of Olly trick, that even though it is split up, Olly will know that the split buffers are actually related to each other to make up a string? Like a way of viewing it as a string even though it isn't as a string.

I can find most of the strings by tracing into the program stopping the trace and then viewing all the referenced strings. But I think it would be good if I knew a way of finding strings like the one in this program as it may be useful sometime.

Thanks.