Log in

View Full Version : How to find all rows/lines with a specific memory address?


tDJ
October 19th, 2005, 10:10
Say there is a line in Olly like this:
CMP WORD PTR DS:[4800A1],0FFFF

If I want to know where "[4800A1]" is set (like "MOV WORD PTR DS:[4800A1],0FFFF" or "MOV WORD PTR DS:[4800A1],AX", then I have to know all "[4800A1]" rows/lines. Is it possible to find them all at once with Olly?

SKiLLa
October 20th, 2005, 14:08
You mean that you want all the code-references to that specific address ?

There are a million ways to reference an address, so just binary-searching for that particular address probably won't find you all references, especially not if the code is trying to hide 'the address'.

IDA has some nice 'reference' & 'graph' features, but it probably won't help you that much. I guess just setting a breakpoint on the address and letting the program run or trace is the easiest method.

tDJ
October 20th, 2005, 15:27
It's enough to see all the ones that are visible in Olly. In this case I usually disassemble the program with W32Dasm, save the comments, open the saved ASM-file in a texteditor and search there for the address. But I thought it would be great if this also could be done simply in Olly.

garryw
October 20th, 2005, 17:29
?, right click on [4800A1] select Find References to | address constant.

tDJ
October 21st, 2005, 01:26
I tried it already, but then only the selected command is found. Same with "Find references to | Selected constant", and "Search for | All constants".