Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 16:30

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 
Author Message
 Post subject: Finding static pointer for dma
PostPosted: 05 Jun 2010 11:00 

Joined: 08 May 2010 17:58
Posts: 55
Location: In vast nothingness of space...
Hi!

I want to find a static pointer for an dynamic adress, the problem is: adress holds text value, and that value is a name, that of course doesnt change during program running, so i cant find out what writes to the adress, but i got the assembly code for what seems to print the name, and check if it's less than 30 chars

so, if you have any idea on how could i find this, it would be really helpfull to me, as i spent countless hours trying to figure out what should i do...
(if you want assembly code that i found, just tell me, il post it up)


Top
 Profile  
 
 
 Post subject: Re: Finding static pointer for dma
PostPosted: 05 Jun 2010 11:26 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
can't you place a write breakpoint on the name in the debugger and check when a function writes to it?
or you refer to something else?


Top
 Profile  
 
 Post subject: Re: Finding static pointer for dma
PostPosted: 05 Jun 2010 11:35 

Joined: 08 May 2010 17:58
Posts: 55
Location: In vast nothingness of space...
when i place it, it wont bump onto it because it is initialized when program starts, and doesnt execute the code that prints name any time else, so i wouldnt get anything (by my logic it wouldnt bump to breakpoint)


Top
 Profile  
 
 Post subject: Re: Finding static pointer for dma
PostPosted: 05 Jun 2010 12:10 

Joined: 08 May 2010 17:58
Posts: 55
Location: In vast nothingness of space...
Well, i think i managed to get something, but im not sure, as i cant test it

76e32038 - 66 89 47 08 - mov [edi+08],ax

was scanning for what writest ot name adress, and when i was closing the program down, this showed up
now, i guess that this would unload the name, or something, but i dont know how to test what would it actually do...

il try to put breakpoint on it and see what acceses it


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: