2

I'm not an expert in reversing and even though Googling is usually enough, this time I can't find a solution.

I have this program that calculates a value from some data it received from a server.

I know the final value and I managed to find it in the memory after the calculation is done, but I want to know which instruction wrote it in the memory.

Is there a way to do that with IDA Pro? I thought about the trace replayer but I never used it and from what I can read this wouldn't work. If not, is there any other disassembler that would make it possible?

1

Cheat Engine is a wonderful dynamic analysis tool for tasks like this. Simply find the memory address storing your value, add it to the address list at the bottom (by double-clicking on it in the results window to the left of the scan box, or click the Add Address Manually button if you have the address to add), then right-click on the address and choose "Find out what writes to this address," as pictured here:

enter image description here

A window will then pop up showing any instructions that write to the address (note that you may have to make the value change before the instruction shows as writing to the address). Also be mindful of the installer as CE is bundled with "offers" you'll most likely want to decline.

  • I'm sorry I should have stated it before, the value is written only once: when I start the program, so I can't put RW breakpoints on the address – René Aug 8 '17 at 15:08
  • 1
    Why should that be a problem? Start program in any debugger and make hardware breakpoint on that specific address then execute it. – J91321 Aug 8 '17 at 15:17
  • If your address is static, then you could set CE to automatically attach when the application launches. At that point, you could pause the process and set a BP on the address prior to the application writing to the address. If it's a dynamic address, then you could give pointer-scanning (tutorial: youtube.com/watch?v=65zjIGKwmSQ) a try to find a static location to set the BP on. Set CE to automatically attach to a process by going to Edit -> Settings -> General Settings -> Automatically attach to process... After that, to pause, you can set a hotkey in settings. – dsasmblr Aug 8 '17 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.