Posted: Mon Oct 10, 2022 2:44 pm Post subject: how to find where a registry is set
Hi first thank you for this amazing piece of software
1 What is the recommended way tracing back where a registry is set?
e.g. I have this
mov [rbx+60],rsi
and I'd like to know where rsi is set.
as a first check it was not in the function and caller is part of a message loop
so when I tried trace breakpoint altough I have got a lot of traces it seemed my function address was not there.
Actually the max count is for the first or last n instructions.
For me it would be good to set last n instructions. Since I want to trace in opposite direction when I hit the breakpoint set to mov instruction
So what is the recommended way of tracing, debugging backward?
In addition may I have some other basic questions:
2 how to move back to actual breaked instruction I can copy EIP and
then use it in go to address is there any more convenient way?
3 how can I create a non-breaking breakpoint with action print a register for example.
4 is it possible to run a lua script when an instruction is executed if yes how _________________
I usually look at the code first because sometime you won't need to trace things back, the value comes from a memory (of another object) that's still valid.
From looking at the code, you can also check whether RSI gets its value in this call.
If it does, you can just run a trace in this call.
Else, look at the stack to find out what function called this one and to the same there.
Take a small step back each time you don't get the answer.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum