Search code examples
reverse-engineeringidaollydbg

Is it possible to view strings in Memory using IDA just like I can in OllyDbg?

I have wrote a simple registration program that requires a Name and License Key in order to get to the success message. The coded solution simply expects both fields to be case sensitive, the Name field must be Admin and the License Key must be TopSecret, both fields must match in order to be a success.

enter image description here

This of course is nothing complex and would never be used in a real world Application but as I am pretty much a beginner in assembly and reverse-engineering this should hopefully serve me well as I gain more understanding of the inner workings of how assembly works.

The ultimate goal for me is to disassemble my own registration schemes and identify how easy it could potentially be to "outsiders" who may try and break it, and as I get better I hope to make my Applications more stronger against such attacks.

In OllyDbg, when setting a breakpoint and stepping over using F8 I can view strings from the memory stack as shown below in the bottom right of the screen:

enter image description here

enter image description here

As you can see highlighted in the green, I entered SOME NAME in the Name field and 123456789 in the License Key field and OllyDbg has managed to show that in what I assume is the Memory Stack.

Is it possible to do this in IDA, and if so how? I have tried opening as many subviews and debugging subviews as possible and yet I cannot see a way of stepping through and watching out for strings in memory. Is there a memory stack window in IDA just like in OllyDbg?

Solution

  • IDA is much more useful when you are doing static analysis. When it comes to dynamic analysis and dynamic debugging, probably IDA is not my favorite tool.

    To see username/password in IDA, just press SHIFT + F12 or go to View -> Open Subviews -> Strings.

    There you should see the strings.

    If you want to do this in dynamic analysis, put the breakpoint in exact same location you did in Ollydbg, then look at stack view.