Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
How can I get the memory referenced in the first operand of the instruction:
mov [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48
I want to do it while tracing over the code so the registers will be known.
I basically need to get the same address that I get if I put the mouse over the first argument:
Thank you
Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.
If you just want to log it to the console, the snippet I would use is:
Message("__GetProcAddress = %08X\n", Dword(ebp+offset));0
Replace offset with the value offset of __GetProcAddress from ebp. You can see it at the top of the function, or if you right click the operand in the instruction you can see what'd it look like if you converted it from a stack variable to a simple offset. It'd look like [ebp+XXh] the XX is the offset you want.
The 0 at the end of condition makes the breakpoint not break, just run the code and continue. If you want it to break you can change that 0 to a 1.
