0

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function responsible for the modification, which also copies the array, presumably on-the-fly.

The memory is dynamic, so I can't set a HW breakpoint ahead of time, but I do know the contents of the unmodifed array. Is there an easier way to find the function that creates the modified array than to try and follow the original array through memory or trace it back? (I have attempted this, but somehow I keep missing it...)

Is there maybe a plugin for OllyDbg that searches through the trace when you point to a memory address that you need to know where it was modified from?

Improve this question
2
  • 1
    Uhm... can you put a breakpoint after the original array is created, get the newly allocated memory address and put a R/W hardware breakpoint on it? I don't use OllyDbg, but I'm sure there must be some method to script it.
    – joxeankoret
    Commented Apr 12, 2018 at 7:57
  • If you know where the alloc is and are using windbg you can provide a command to run when a breakpoint gets hit. So you can break on wherever the allocation return is and use the command to set a second breakpoint. e.g.: bp <addrOfAllocReturn> "ba w 4 <eaxOrAllocRet>". You can do something similar with conditional breakpoints in Olly
    – Fewmitz
    Commented Apr 13, 2018 at 4:51

1 Answer 1

Reset to default
1

The only thing you can do with the dynamic analysis is to find where the final block is allocated. For this you need to enable memory allocation tracing with

gflags.exe /i yourApplication.exe +ust

Then use windbg and !heap -p -a command on the block address, it will print you the call stack which allocated this memory. So at least you'll have the idea where it was allocated, and you'll be able to put hardware breakpoint at the allocation point.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.