View Full Version : [Help] How to search for a value ...
gaitmia
December 4th, 2006, 17:45
Hi, i would like to find an instruction that puts the value byte CBh into some address that i don't know. But, this byte is NOT a constant! So i can't just use the "Search for > Constant" feature to search for it because the byte is created in run-time from some place.
I tried to use the Trace function setting the "Condition is TRUE: CB", but it doesn't pause the execution. Give me some ideas please.
Thanks very much!
naides
December 4th, 2006, 19:18
Ummh. . .
I am not sure I understand what you are trying to do.
You want to find an INSTRUCTION. That much I got.
The instruction writes a BYTE to a place in memory. The byte itself is generated at run time and You don't know where or how is created. Am I right??
I think code that takes an undefined single byte from and undefined place in memory and writes it to another undefined place in memory is way too frequent for you to narrow down that operation with a debugger, given the information you are providing.
Perhaps, if the program is not very big, instructions that read or write one byte at a time are relatively rare in code. most of the time dwords get read and write, but I would not count on it to narrow the search for your magic instruction all that much.
Unless I am missing something very obvious in your post (Yes, I am kinda dumb) you need to provide more information/more clues about what you are trying to accomplish so one of the Olly geniuses in the board would give you a solution. . .
gaitmia
December 4th, 2006, 22:19
You have understood all i need. It's exactly as u said.
I'm trying to decipher an internet packet from an application.
I know the place where the packet itself is created and where it is sent from, but i don't know where this specific byte, which is inside of the packet, is being writen in the memory.
So, i need an way to break on the instruction where the app writes this number in the memory. (something like: MOV [address], BL where address will contain the byte stored in BL register)
naides
December 5th, 2006, 05:22
OK. That is more like it.
One possible strategy is to learn the contents of a packet with a Sniffer, while the application is running under Olly.
Then stop the application and search for the bytes of the packet in the application memory.
With a little luck, the buffer that holds the packet is used and reused. or at least try to learn how the buffer that holds packet contents is is allocated, or, try to make the app break after the packet is received but before it is read (Moved?).
Then is question of placing memory breakpoints to catch who reads, and writes into the allocated buffer(s).
gaitmia
December 5th, 2006, 22:10
Thanks very much for these tips!
Powered by vBulletin® Version 4.2.2 Copyright © 2020 vBulletin Solutions, Inc. All rights reserved.