View Single Post
AMX Mod X Plugin Approver
Join Date: Oct 2005
Old 03-10-2011 , 06:12   Re: Orpheu: How to make signatures (of bytes)
Reply With Quote #24

To search a function in windows, it's a matter of searching string and/or looking where are referenced a function. Here, the function is filled with string. It will be easy to find it.

So, you have just to pick up a string in linux, copy, and checking in windows.

To check a string among the referenced ones, go to View > Open subviews > Strings. Then in this new tab, search for a specific string. You can do Search > Search... or ALT + T.
Once you done, click on the string, you will be redirected where the string is referenced.

From there, you can see a variable (aSomething) associated to the full string name and its xrefs. xrefs are where are referenced the string in the functions. By default it shows only the 2 first xrefs and to have a full list you need to select the variable and clicking right on Jump to xref to operand... or use X. Now it's just a matter to click on it and see if it's the right function. For this function, you're lucky it's actually easy. :p.
Arkshine is offline