Joined: 09 May 2003 Posts: 25958 Location: The netherlands
Posted: Tue Jun 14, 2011 1:22 pm Post subject:
no, you have to be more specific
alternatively write a plugin that sets that memory to not accessible and register a debugger callback and handle it yourself (will be slow and/or high chance of crashes in a multi threaded process) _________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
Joined: 09 May 2003 Posts: 25958 Location: The netherlands
Posted: Tue Jun 14, 2011 2:25 pm Post subject:
well, if you copy that whole region to another section, adjust relative jumps that go outside the region to jump to the original code and then set every byte in that region to a software breakpoint, then perhaps it's possible
On breakpoint change eip to the copy and then setup for single step continues until you're outside of the copied region
during the single steps you disassemble each instruction and evaluate the address being accessed and write that down
but are you sure that is what you need? Can't you come up with an easier method ? _________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum