0

Say, if I have the following disassembly:

enter image description here

How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me too many results.

PS. I'm using IDA Pro as a disassembler, while stepping through kernel32.dll with WinDbg as a debugger in a user mode. In the screenshot above the EIP (breakpoint) is currently at the 744E78D6 opcode of interest.

2

IDA's xref functionality only works for static references. The references it detects by statically analyzing the code. It cannot find any dynamic or runtime references to addresses using the xref functionality.

Instead, you'd need to use the memory breakpoint feature IDA's debugging interface has (or any other debugger, for that matter) to breakpoint any time a memory address is accessed. Be advised memory breakpoints has several caveats such as incurring a noticeable performance penalty and being detectable by anti-debugging techniques. Hardware breakpoints may also be used for the same purpose but are harder to detect by anti-debugging techniques.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.