0

enter image description here

Here is a list of all the places where this specific function gets called. What that function does is return 0.01666 from a pointer. That value is being used in the physics calculations of the game. If i change the value to something else, obviously the physics changes.

Now let's get to the real problem here, i want to find where this function constantly gets called, so it will be easier to find which functions are physics related (functions inside a inf loop or whatever, that constantly call that return function). I know i have to do this while debugging but i need the fastest way of narrowing down the list.

I hope the explanation doesn't sound retarded.I started reversing recently :)

  • What tool are you using? It would really be useful to know that. – usr2564301 Jan 12 '18 at 23:51
  • @usr2564301 looks like IDA... – Igor Skochinsky Jan 13 '18 at 11:20
2

I'd solve this by running the target in a debugger and putting a logging bp on the function (OllyDbg has them, should be Ctrl+F2 if I remember correctly) that just writes out the return address from the stack.

That will spam your log and you quickly should see which return address appears the most.

0

If this is for a game and you want to approach this via dynamic analysis, my personal approach is to use Cheat Engine, then in the Memory Viewer window, click Tools -> Dissect Code.

You can now go to the prologue of that function you're interested in, then see all the calls that lead to the function (they'll be grouped via multiple lines just above the first instruction of the sub-routine). You can then double-click on any of those calls to go to that particular call's location and start having a field day researching from there.

I'm sure there is either in-built functionality or plug-ins you can use to essentially achieve the same sort of code analysis to find all calls to thing statically via x64dbg, IDA, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.