RileyRR
September 22nd, 2004, 20:56
Been trying my hand out at scripting and have the following question. Is it possible to use the FIND command such that it searches from the ADDR upwards and not downwards? My entry point into my program is already below the point I want to find. I tried searching from MODULEBASE or CODEBASE, but, since the program is packed, they are no where near where I need to be. I know I can just subtract a certain amount from the program entry point and I will find what I need, but I was hoping that the script could be generic (not sure if subtracting a given amount will work on all types of these packed programs - may land outside the code region). It would be ideal if I could search upwards, or somehow identify the first valid instruction in the module. Thanks for your help.