Posted: Sun Jun 01, 2014 8:08 pm Post subject: How to filter out multiple values on "Find out what add
Hi, my english is not perfect, I'm trying my best to be as clear as possible.
I'm also quite noob, but I really want to learn.
I'm trying to find and store the address of a value with Auto Assembler. I've found which instruction writes to my address and used that to get the address, but the "Find out what addresses this instruction accesses" function, for that instruction that actually has my address as argument, gives me multiple values.
I tried to find a workaround by doing some subtraction and comparison between registers, worked for a while, then I realized that this was not a static thing.
There is no solution that works for every case. You must keep experimenting to find some way to uniquely identify your particular value. If you can't find it in the registers, try looking around in the stack (esp) or try using the structure dissector on the memory near your variable to find something unique you can check. Alternatively, you can try the pointer scanner. _________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on...
If you want to store the address of a value with AA just use MOV command.
In "Find out what addresses this instruction accesses" function you have a list of all addresses that uses this opcode from there you can find other values of useful things.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum