1

Hello I try to learn reverse engineering, so i use from process hacker to view dynamic strings in the process's memory... (more info)

i get something like this :

Address  Length Result
-----------------------
0x853978 (43): hello
0xfb5e1a8 (86): hello alex !

now i want to know how can i get/find reference address for them ?

I try with WinHex but i cant, i don't know how can i do this, is it possible to find reference assembly address in file form memory address (for ex : 0x853978) or this is not possible in any way.

anyone can help ?

MrUnknow
  • 13
  • 2

1 Answers1

2

When you are using Process Hacker to find strings, you will look at a running process. Process Hacker iterates over the mapped parts of the processes virtual memory and tries to parse everything it finds as a string.

When you use WinHex to look at your binary, these sections have not been mapped yet and are cramped together into the binary.

tl:dr;

Use another program to check for strings (e.g. exe explorer, pe studio, ida, binaryninja, ...), use a debugger to find the strings at the adresses process hacker tells you, or calculate the file offset utilizing the section information.

Could you clarify what you are trying to do?

edit

if you want to find references to strings in code, you are best off utilizing a decent disassembler (binaryninja, radare2, ida pro). It will show you references it can find:

enter image description here

Nordwald
  • 2,896
  • 13
  • 25