如果您知道 eax 可能在某个时刻包含字符串或 [esp+8] 在某个时刻包含字符串，那么您应该掌握一些东西

您可以使用 ollydbg's (1.10) Set Condition to RunTrace 并跟踪执行

一个简单的消息框应用程序加载在 ollydbg poi(esp+4) 中，当调用 user32 时中断！MessageBoxW 将包含我知道的文本，所以让我设置 ctrl+t 条件如下并跟踪 (ctrl+f12)

UNICODE [[esp+4]] == "cannot" 

这是 [[esp+4]] 是 unicode 字符串“找不到 XXXXXXXXXXX”的所有中断的日志

在最后一个日志之前，我将 srch 字符串修改为 "say"

Log data
Message
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401011  stack contains  unicode [[esp+4]] = cannot find "hello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401025  stack contains  unicode [[esp+4]] = cannot find "iello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401039  stack contains  unicode [[esp+4]] = cannot find "jello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 40104d  stack contains  unicode [[esp+4]] = cannot find "fello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find "kello"
broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find "kello"
Conditional pause: UNICODE [[esp+4]] == "say"
broke here eip  = 401075  stack contains  unicode [[esp+4]] = saying "hello" baby

还可以设置复杂的条件来定位感兴趣的 srch 模式

这是ollydbg打开记事本，exe并在eip> imagebase与ctrl + f11（trace in）时查找cmd.exe的路径的日志

Run trace, selected line
 Back=141932.
commands before pausing 

日志

Log data, item 0
 Message=Conditional pause:  eax > 0x400000  &&  UNICODE [eax] == "c:\\windows\\system32\\cmd.exe"

where eip was 
Log data, item 0
 Message=eip = 7c918154

这是 ntdll!_wcscat 的一部分

7C91814E        /MOV     CX, WORD PTR DS:[ESI]       ;  55.
7C918151        |MOV     WORD PTR DS:[EDX], CX       ;  55.
7C918154        |INC     EDX                         ;  54.
7C918155        |INC     EDX                         ;  54.
7C918156        |INC     ESI                         ;  54.
7C918157        |INC     ESI                         ;  54.
7C918158        |TEST    CX, CX                      ;  54.
7C91815B        \JNZ     SHORT ntdll.7C91814E        ;  54.

whcih 显示动态构造的字符串 ise

Log data, item 0
 Message=edx  = 5cb800f4  unicode [edx]  = e  cx  = 65  unicode [eax] = C:\WINDOWS\System32\cmd.exe

将55. / 54.在拆装算打破之前的指令被执行 len ( unicode ( c:\windows\system32\cmd.exe)) == 53 . / chars从1个EAX成为srchstr和OllyDbg的爆发下一个指令尚未被执行计数开始

copy con strlen
C.:.\.W.I.N.D.O.W.S.\.S.y.s.t.e.m.3.2.\.c.m.d...e.x.e^Z
        1 file(s) copied.

wc strlen
      0       1      53 strlen

阅读评论似乎对上述建议的方法存在误解，因此要澄清这不是条件断点，并且与任何应该事先知道的偏移量无关，这种设置暂停的方法是对每个步骤的条件进行动态评估(trace in 和trace over) 满足条件时暂停trace 也可以修改inflight