Timeline for Finding source of memory modification
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 13, 2018 at 4:51 | comment | added | Fewmitz | If you know where the alloc is and are using windbg you can provide a command to run when a breakpoint gets hit. So you can break on wherever the allocation return is and use the command to set a second breakpoint. e.g.: bp <addrOfAllocReturn> "ba w 4 <eaxOrAllocRet>". You can do something similar with conditional breakpoints in Olly | |
| Apr 12, 2018 at 10:18 | answer | added | Anton Kukoba | timeline score: 1 | |
| Apr 12, 2018 at 7:57 | comment | added | joxeankoret | Uhm... can you put a breakpoint after the original array is created, get the newly allocated memory address and put a R/W hardware breakpoint on it? I don't use OllyDbg, but I'm sure there must be some method to script it. | |
| Apr 12, 2018 at 0:22 | review | First posts | |||
| Apr 12, 2018 at 14:00 | |||||
| Apr 12, 2018 at 0:20 | history | asked | Mars | CC BY-SA 3.0 |