3

How can I get the memory referenced in the first operand of the instruction:

mov     [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48

I want to do it while tracing over the code so the registers will be known.

I basically need to get the same address that I get if I put the mouse over the first argument:

mouse over first move operand

Thank you

1

Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.

If you just want to log it to the console, the snippet I would use is:

Message("__GetProcAddress = %08X\n", Dword(ebp+offset));0

Replace offset with the value offset of __GetProcAddress from ebp. You can see it at the top of the function, or if you right click the operand in the instruction you can see what'd it look like if you converted it from a stack variable to a simple offset. It'd look like [ebp+XXh] the XX is the offset you want.

The 0 at the end of condition makes the breakpoint not break, just run the code and continue. If you want it to break you can change that 0 to a 1.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.