I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function responsible for the modification, which also copies the array, presumably on-the-fly.
The memory is dynamic, so I can't set a HW breakpoint ahead of time, but I do know the contents of the unmodifed array. Is there an easier way to find the function that creates the modified array than to try and follow the original array through memory or trace it back? (I have attempted this, but somehow I keep missing it...)
Is there maybe a plugin for OllyDbg that searches through the trace when you point to a memory address that you need to know where it was modified from?