0xf0001
January 21st, 2004, 20:09
hi there!
I am currently looking at a kinda famous "old" protection that deals with pcode and therefor started using the WKTVBDEbug. since this protection uses an OCX i shortly ran into this bug when debugging this OCX (yes, i try the hardcore approach on this gggg)
so why not put on top of beeing somehow in the very dark with this topic - come to the conclusion that i have NO tool that does what I need. cause also WKTVBDE that would be it has such an annoying limitation that you cannot BPX into an address that you can not currently doubleclick in your small code window.
that is very bad, because you can always start from the beginning and not just jmp where you already were. you have to trace it everytime. kinda new game new luck thing ggg
fortunately WKTVBDE was very gently written for reversing and it turned out to be quite easy to change the thing:
when you <ctrl-e> and enter an address for your breakpoint and it has 8 characters (the OCX for sure ALWAYS has) the last character will be cut off (lowest nibble) but hey you get an extra "0" in front of it (highest nibble)
making from my input eg 1100eebf -> 01100eeb. ups.
i have written also a short tutorial about how to patch it that i think fits quite good for a newbie/beginners "reversing" tutorial - since it is very basic.
have phun!
greetz, da 0xf001
I am currently looking at a kinda famous "old" protection that deals with pcode and therefor started using the WKTVBDEbug. since this protection uses an OCX i shortly ran into this bug when debugging this OCX (yes, i try the hardcore approach on this gggg)
so why not put on top of beeing somehow in the very dark with this topic - come to the conclusion that i have NO tool that does what I need. cause also WKTVBDE that would be it has such an annoying limitation that you cannot BPX into an address that you can not currently doubleclick in your small code window.
that is very bad, because you can always start from the beginning and not just jmp where you already were. you have to trace it everytime. kinda new game new luck thing ggg
fortunately WKTVBDE was very gently written for reversing and it turned out to be quite easy to change the thing:
when you <ctrl-e> and enter an address for your breakpoint and it has 8 characters (the OCX for sure ALWAYS has) the last character will be cut off (lowest nibble) but hey you get an extra "0" in front of it (highest nibble)
making from my input eg 1100eebf -> 01100eeb. ups.
i have written also a short tutorial about how to patch it that i think fits quite good for a newbie/beginners "reversing" tutorial - since it is very basic.
have phun!
greetz, da 0xf001