000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367"

I see the above line in the ollyDBG which has the value of "500117367" according to the comment made by the ollyDBG itself.

However, I don't know how to access the dereferenced pointer value. When I press Ctrl + G and go to the 7FEEC617750 memory address, I get an expression like push rbx which is not the value shown in the ollyDBG.

I am pretty confused by how I should use the offsets and stack in ollyDBG. I simply want to know how to access the value of pointer shown in the comment of ollyDBG [7FEEC617750] and also find out what accesses and writes to [7FEEC617750].

P.S Thanks to AcidShout for pinpointing, indeed, the debugger is x64_dbg the cousin of ollyDBG :)

  • 1
    There's no dereference happening there. What you see is equivalent to mov rcx, 0x7FEEC617750. lea does not dereference even though the value is inside brackets [] – rev Aug 28 '15 at 19:19
  • 1
    Also, how are you debugging x64 code inside Olly? – rev Aug 28 '15 at 19:20
  • @AcidShout Indeed it is x64_dbg the cousin of ollyDBG :) sorry about representing the issue in the wrong way I am newbie in reversing. – FreeMind Aug 28 '15 at 19:33
up vote 6 down vote accepted

Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that address:

Follow in Dump

To see what accesses and writes to the memory at that address, right-click in the dump pane on the first byte of memory at that address and set a hardware breakpoint on-access:

Hardware Breakpoint

Edit:

All that said, AcidShout's two comments above in response to your question are spot-on!

  • Thanks for the answer. Indeed, I am using the x64_dbg, anyway the solution is the same. – FreeMind Aug 28 '15 at 19:43
  • Anyway, whenever I put a breakpoint the program crashes. What should I do in such situation?! – FreeMind Aug 28 '15 at 19:53
  • One question per post. Please create a new post for that new question. – Jason Geffner Aug 28 '15 at 19:55
  • It is alright but the crashing is related directly to this question?! – FreeMind Aug 28 '15 at 19:57
  • Please check out reverseengineering.stackexchange.com/questions/10741/… – FreeMind Aug 29 '15 at 13:42

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.