This is probably very simple for you guys, and may seem trivial or stupid. But it is just for experience like the last thing I did

The string it uses to reply as a version is "mIRC v6.17 Khaled Mardam-Bey", I couldn't see that in hex or when I viewed all referenced strings in olly. I could however find v6.17 in hex and when I searched for strings in memory in olly. Which makes me think that he is using something like.

"%s%s%s", programname, programversion, myname

At the place in memory where I found v6.17 I tried changing the 7 to an 8, then versioned myself. It replied with v6.18 so that must be the correct place. I was thinking he might be using programname/programversion in other parts of the program aswell so I was hoping I could find a solution without editing them. I had a thought that maybe I could edit the ""%s%s%s" (if I can find it) to a string literal instead, or perhaps point it to a different place in the file where there are some spare bytes and that I could write my own version string.

I think the problem I am faced with at the moment is that I don't know how to find %s%s%s, I searched for all referenced strings, and then searched those strings for %s%s%s there were quite a few of these. And I didn't really want to look at each one of them. Plus I think checking each one isn't really an effective method. So I was wondering, if I know the place in memory where v6.17 is stored, is there a way I can find where it is referenced in the program?

Thanks in advance guys.