| View previous topic :: View next topic |
| Author |
Message |
jrandomhacker
How do I cheat?
![]() Reputation: 0
Joined: 26 Feb 2019
Posts: 3
|
 Posted: Tue Feb 26, 2019 6:40 pm Post subject: Weird issue with Disassembly vs Hex View |
 |
|
Got a bit of a weird one (the way I found it was a bit circuitous so I'll save you the details).
Looking at a particular address in my target process in Memory Viewer, and the Disassembly view is disagreeing with the Hex View...
Not sure what's up with that, but when I dump that memory region I get the data as it appears in the Hex View.
Seems like it's maybe a bug? Unless the target process is doing something really weird and the memory's getting updated without the assembly view updating?
I saw a similar issue when I dumped a specific function a while back, the initial 55 (push ebp) was dumped as CC (int 3), didn't think anything of it at the time.
Anybody seen this type of thing before?
| Description: |
|
| Filesize: |
10.8 KB |
| Viewed: |
1208 Time(s) |
|
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25796
Location: The netherlands
|
| Posted: Tue Feb 26, 2019 11:49 pm Post subject: |
|
|
That is because you've changed the memory to cc by placing a software breakpoint at that location
CE's disassembler knows this in order to kerp showing the original instruction, but hexview has no need for dealing with that so shows you how it is
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
jrandomhacker
How do I cheat?
![]() Reputation: 0
Joined: 26 Feb 2019
Posts: 3
|
| Posted: Wed Feb 27, 2019 1:44 am Post subject: |
|
|
Ah, *facepalm* of course that makes perfect sense (note to self, dump before setting software breakpoints in future  ).
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
