It's a bit hacky, anyone with a more efficient solution is welcome to share.Its been some time since I have written a reverse engineering tutorial, & I thought it would be good to cover one at the dead of night :) What I am going to teach you today, is a simple reverse engineering tutorial.We will be cracking A-one Video to Audio convertor today, with just simple cracking. I searched the code for '2C 51 40 00' which is the address backward, and i found my PUSH again. PS : the string doesn't appear in 'referenced text strings' either.ĮDIT : okay so I found a solution. So TL DR question : how do I automatically find a command referencing a string ? Because obviously I'm not gonna scroll the whole command stack everytime I want to find a string. You can also notice that the string's address is the same as the PUSH's argument (40512C).Īs a last try, I right click on the letter at address 40512C, select 'Find References', but nope : no reference found. However, I still haven't found my original PUSH. So yeah, we found our string in the dump. so I right click => Follow in Dump, and I get this : Okay, that's not what I expected, but let's see what's in there. So I get to the top of the program, hit CTRL+B and search for ASCII 'File' to hopefully find it again :Īfter hitting OK, OllyDbg doesn't find the earlier PUSH. So I thought : 'If I can find this information by simply scrolling, surely there must be an automatic way to find a command referencing a particular string'. So in this particular crackme, I was scrolling through the commands and noticed a PUSH with an ASCII string '&File' (it's a menu string) : I've taken up cracking and reverse-engineering recently with the help of OllyDbg 2.01 and crackmes executables.

All referenced text strings ollydbg