Timeline for Question about interaction between some message-functions()
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 1, 2014 at 14:55 | comment | added | 0xec | @user3097712 It's not process, it's address of the procedure. See on MSDN | |
| Oct 31, 2014 at 19:26 | comment | added | user3097712 | hahaha...sometimes I could beat myself for my stupidity. I opened the program with ollydbg, go to mentioned place and then I see that ollydbg shows me the real name of the process. It is "RegisterServiceProcess". But thanks for your advice with the breakpoint. I´ve perceived it. | |
| Oct 31, 2014 at 19:03 | comment | added | Jason Geffner | Thanks for your comment. I've updated my answer above with an alternative approach. | |
| Oct 31, 2014 at 19:03 | history | edited | Jason Geffner | CC BY-SA 3.0 |
added 247 characters in body
|
| Oct 31, 2014 at 18:58 | comment | added | user3097712 | yes, I have tried that, too. I marked "offset UmehyJ{j" and click Strg+X to get the cross-reference list of offset UmehyJ{j , but in the list the mentioned line with mov eax, offset UmehyJ{j is the only place where that string appears. There is no other reference to it. | |
| Oct 31, 2014 at 15:51 | history | answered | Jason Geffner | CC BY-SA 3.0 |