views:

24

answers:

2

Here is my issue. I'm trying to learn how to do debugging in assembly with OllyDBG. Usually, when a string is literally in the application, I can find something that points to it, however, this string is from the resource file (when doing WinAPI programming, a resource, .rc, is used). Therefore, given that it is in resource data, how can I find out where this string is called upon in the disassembly?

Thanks

+2  A: 

Put breakpoint to LoadStringW and wait this string. (Of course conditional BP is better than repeatedly press [F9])

But it's better first to do a static analysis (disassemble file), then use OllyDbg to debug it, if needed.

For example during static analysis you can find all LoadStringW calls, and find which loads the string by its ID.

Abyx
+1  A: 

You should check string table using some resource editor (for example ResEdit) and find ID of string that you are searching. Then you should put the break on LoadString function calls and check what ID it loads.

Zuljin