Joined: 09 May 2003 Posts: 25802 Location: The netherlands
Posted: Thu Apr 02, 2015 6:10 am Post subject:
The manual stacktrace is if you have a arbitrary stack location and wish to trace it. (e.g not at the current top of the thread it belongs to)
The use shadow copy is used when you've made a copy of the stack
Because stack pointers point to the original stack, this will cause it to internally handle a reference to the original base to be converted to a reference to the new copy
so if you made a copy of the stack that was originally at 008f0000 and put it at 10000000 and do a stacktrace. It'll convert fields in the stack that reference 008f0000->stacksize to 10000000->stacksize
This 'shadow' behavior is also available in the structure spider
(And that is why the "lock" function in structure dissect also shows the shadow copy location when you rightclick the address) _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum