0

In a program I'm working on, a variable is set using a memory address:

mov r9, [0x0000000000472C10]

Is this the equivalent? (forgive the python code):

value = 55 <---- value at memory address 472C10?
...
x = number <---- x is set from r9?

In that case, instead of the hard-coded 55 in the code, I'd like to use my own number. The trouble is I don't know how to access it. My own value has been defined somewhere in the program for example:

user_value = getValue()
...
# assuming we're still in the same function
...
value = 55

How can I now change value to be equal to user_value, where can I find the memory address of user_value so I can change the mov instruction?

edit: I know that x64dbg has a way of tracing registry changes, could this be a way of tracking when 55 is set?

  • mov[addr] , value mov regisrer,[addr] – blabb Mar 29 '18 at 3:08
  • Could you elaborate a little? What's value here? – Lobstw Mar 29 '18 at 19:35
  • Before I post an answer, let me clarify a few things to make sure I have your question right. 1) You want to find the hard-coded 55 in memory, but you don't know the address. 2) You want to change the value in that memory address to whatever is in the user_value mem address, of which you also do not know. Is this value one you can change multiple times during execution? 3) Are you just assuming that mov instruction, or do you know the value is being read just like that? 4) Have you ever used memory scanning, like via Cheat Engine? If not, that's the path I'm going to answer you with. – dsasmblr Mar 30 '18 at 13:07
1

it is a simple assignment like

int a = x; int *b = &a;

if r9 is used then it possibly means the 4 th argument is being initialised

you can see your construct in code like this

int *blah;
int foo(int,int,int,int *c){
    register int b = *c;
    return b * 3;
}
int main (void) {
 int f = 0xdeadbeef;
 blah = &f;
return foo(1,2,3,blah);
}

see how r9 is initialized for this code

>dumpbin /disasm:nobytes /range:0x140001030,0x140001068 pointer.exe
Microsoft (R) COFF/PE Dumper Version 14.13.26129.0
Dump of file pointer.exe
File Type: EXECUTABLE IMAGE
  0000000140001030: sub         rsp,38h
  0000000140001034: mov         dword ptr [rsp+20h],0DEADBEEFh
  000000014000103C: lea         rax,[rsp+20h]
  0000000140001041: mov         qword ptr [0000000140003000h],rax <<<<<<
  // mov [addr] , value (value here is 0xdeadbeef) 
  // if you do r eax = 55 then you got what you wanted here wrt windbg
  0000000140001048: mov         r9,qword ptr [0000000140003000h] <<<<<<<<
  // mov register [addr]
  000000014000104F: mov         r8d,3
  0000000140001055: mov         edx,2
  000000014000105A: mov         ecx,1
  000000014000105F: call        0000000140001000
  0000000140001064: add         rsp,38h
  0000000140001068: ret

in such cases if you want r9 to be say 55 you need to patch the contents of the address 0x140003000 or some such address
one way to get that address is debug or use some memory scanning tools like cheat engine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.