1
000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:"500117367"

I see the above line in the ollyDBG which has the value of "500117367" according to the comment made by the ollyDBG itself.

However, I don't know how to access the dereferenced pointer value. When I press Ctrl + G and go to the 7FEEC617750 memory address, I get an expression like push rbx which is not the value shown in the ollyDBG.

I am pretty confused by how I should use the offsets and stack in ollyDBG. I simply want to know how to access the value of pointer shown in the comment of ollyDBG [7FEEC617750] and also find out what accesses and writes to [7FEEC617750].

P.S Thanks to AcidShout for pinpointing, indeed, the debugger is x64_dbg the cousin of ollyDBG :)

3
  • 1
    There's no dereference happening there. What you see is equivalent to mov rcx, 0x7FEEC617750. lea does not dereference even though the value is inside brackets []
    – rev
    Commented Aug 28, 2015 at 19:19
  • 1
    Also, how are you debugging x64 code inside Olly?
    – rev
    Commented Aug 28, 2015 at 19:20
  • @AcidShout Indeed it is x64_dbg the cousin of ollyDBG :) sorry about representing the issue in the wrong way I am newbie in reversing.
    – FreeMind
    Commented Aug 28, 2015 at 19:33

1 Answer 1

6

Right-click on the disassembly line above in OllyDbg and choose Follow in Dump. That will tell OllyDbg to navigate to address 7FEEC617750 in the dump pane and allow you to see the memory at that address:

Follow in Dump

To see what accesses and writes to the memory at that address, right-click in the dump pane on the first byte of memory at that address and set a hardware breakpoint on-access:

Hardware Breakpoint

Edit:

All that said, AcidShout's two comments above in response to your question are spot-on!

5
  • Thanks for the answer. Indeed, I am using the x64_dbg, anyway the solution is the same.
    – FreeMind
    Commented Aug 28, 2015 at 19:43
  • Anyway, whenever I put a breakpoint the program crashes. What should I do in such situation?!
    – FreeMind
    Commented Aug 28, 2015 at 19:53
  • One question per post. Please create a new post for that new question. Commented Aug 28, 2015 at 19:55
  • It is alright but the crashing is related directly to this question?!
    – FreeMind
    Commented Aug 28, 2015 at 19:57
  • Please check out reverseengineering.stackexchange.com/questions/10741/…
    – FreeMind
    Commented Aug 29, 2015 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.