Posted: Thu Dec 19, 2019 8:52 am Post subject: How to follow this value ?
Hi.
I need help with a part of code.
I usually follow my value with:
-Find What access this value
then Trace what i want and read the code and so on
So i have a value 40000000 that is move somewhere then read then move again
My first problem was the last code is used to move multiple value
so i put my trace on next instruction with a start condition EDX == 0x40000000
but i' ve made some trace and ecx change each time
so i can't add the next moving address and find what access it.
Looks like some kind of indexed table, I guess ECX changes based on what position the record you want occupies.
Well, if ESI is fixed, then you need to follow ECX.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum