Reverse Engineering for Beginners

CHAPTER 15. SIMPLE C-STRINGS PROCESSING CHAPTER 15. SIMPLE C-STRINGS PROCESSING

Optimizing MSVC + OllyDbg

We can try this (optimized) example in OllyDbg. Here is the first iteration:

Figure 15.1:OllyDbg: first iteration start

We see that OllyDbg found a loop and, for convenience,wrappedits instructions in brackets. By clicking the right button on
EAX, we can choose “Follow in Dump” and the memory window scrolls to the right place. Here we can see the string “hello!”
in memory. There is at least one zero byte after it and then random garbage. If OllyDbg sees a register with a valid address
in it, that points to some string, it is shown as a string.