PDA

View Full Version : Referenced by addresses

Vinod
March 31st, 2008, 07:26
Hello,

need a clarification on these referenced addresses while looking up for RtcMsgBox values--whether it is the first reference or the second?




* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407F9B(C)
|
:00407FC0 C78504FFFFFF00000000 mov dword ptr [ebp+FFFFFF04], 00000000

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407F19(C), :00407FBE(U)
|
:00407FCA C745FC06000000 mov [ebp-04], 00000006
:00407FD1 C7459404000280 mov [ebp-6C], 80020004
:00407FD8 C7458C0A000000 mov [ebp-74], 0000000A
:00407FDF C745A404000280 mov [ebp-5C], 80020004
:00407FE6 C7459C0A000000 mov [ebp-64], 0000000A
:00407FED C745B404000280 mov [ebp-4C], 80020004
:00407FF4 C745AC0A000000 mov [ebp-54], 0000000A


please do spend couple of minutes of your valuable time to guide me thro this..the disassemble text file is attached for easy reference.

Regards,
vinod
naides
March 31st, 2008, 11:23
Quote:
[Originally Posted by Vinod;73722]
Code:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00407F9B(C)

|                    ; If you pan up to the code address   00407F9B  you will see a conditional jump (C)  pointing to 00407FC0 

:00407FC0 C78504FFFFFF00000000    mov dword ptr [ebp+FFFFFF04], 00000000



* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00407F19(C), :00407FBE(U) ; This place: 00407FCA gets "jumped to" from two places:  00407F19  with a Conditional jump and 00407FBE with an unconditional jump

|

:00407FCA C745FC06000000          mov [ebp-04], 00000006

:00407FD1 C7459404000280          mov [ebp-6C], 80020004

:00407FD8 C7458C0A000000          mov [ebp-74], 0000000A

:00407FDF C745A404000280          mov [ebp-5C], 80020004

:00407FE6 C7459C0A000000          mov [ebp-64], 0000000A

:00407FED C745B404000280          mov [ebp-4C], 80020004

:00407FF4 C745AC0A000000          mov [ebp-54], 0000000A





The comments are attached to the destination of the jump which is the code address immediately after the comment.