Noxerus
April 20th, 2008, 17:25
I'm having a strange problem with findcmd in ODbgScript 1.64.
I want to find the closest appearance of a certain asm command after eip, so I use the following script:
The problem is that the result I get appears much before eip...
Investigating this problem, I opened the references window and found that Olly has searched for my command in a large block which has eip at its center. When I call "gref 1", instead of getting back the address of the first instance of "push 100" after eip, I get the first instance of "push 100" in the current memory block.
What can I do to fix this?
Thanks in advance.
I want to find the closest appearance of a certain asm command after eip, so I use the following script:
Code:
findcmd eip, "push 100"
gref 1
msg $RESULT
The problem is that the result I get appears much before eip...
Investigating this problem, I opened the references window and found that Olly has searched for my command in a large block which has eip at its center. When I call "gref 1", instead of getting back the address of the first instance of "push 100" after eip, I get the first instance of "push 100" in the current memory block.
What can I do to fix this?
Thanks in advance.