Posted: Sun Jan 06, 2013 2:46 pm Post subject: Locating structures as they're formed?
How would I go about finding a specific type of structure in a program's memory as it's created (therefore finding the code that generates it)? _________________
I had a life? O.o
I thought my job was to collect information and help, then one day hope to use it. :S
Joined: 09 May 2003 Posts: 25837 Location: The netherlands
Posted: Sun Jan 06, 2013 5:37 pm Post subject:
Place a hook at all memory allocation routines, and all internal allocation routines as well.
Then each time a block is allocated start single stepping until the first few bytes have been written to the allocated memory block. That should be enough to identify if it's the structure is that you want or not. If it is, you're in the function that creates it.
Now just find where the start of the function is (stacktrace) and you're done
alternatively, perhaps you might find a pointer to the class definition (vtable like thingy) and find the constructor method of the class. If you place a hook on the constructor you might be able to find the caller then as well.
It may take several tries till you've found the constructor though as it's not always the first method, and there can be multiple constructors _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum