I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function responsible for the modification, which also copies the array, presumably on-the-fly.

The memory is dynamic, so I can't set a HW breakpoint ahead of time, but I do know the contents of the unmodifed array. Is there an easier way to find the function that creates the modified array than to try and follow the original array through memory or trace it back? (I have attempted this, but somehow I keep missing it...)

Is there maybe a plugin for OllyDbg that searches through the trace when you point to a memory address that you need to know where it was modified from?

  • 1
    Uhm... can you put a breakpoint after the original array is created, get the newly allocated memory address and put a R/W hardware breakpoint on it? I don't use OllyDbg, but I'm sure there must be some method to script it. – joxeankoret Apr 12 '18 at 7:57
  • If you know where the alloc is and are using windbg you can provide a command to run when a breakpoint gets hit. So you can break on wherever the allocation return is and use the command to set a second breakpoint. e.g.: bp <addrOfAllocReturn> "ba w 4 <eaxOrAllocRet>". You can do something similar with conditional breakpoints in Olly – Fewmitz Apr 13 '18 at 4:51

The only thing you can do with the dynamic analysis is to find where the final block is allocated. For this you need to enable memory allocation tracing with

gflags.exe /i yourApplication.exe +ust

Then use windbg and !heap -p -a command on the block address, it will print you the call stack which allocated this memory. So at least you'll have the idea where it was allocated, and you'll be able to put hardware breakpoint at the allocation point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.