1

I am tracking down a data structure whose address is inside the second operand:

mov rcx, qword ptr ss:[rbp+E0]

When I look at the value of [rbp+E0] I see the following dump:

21 C4 FC 5E 00 00 00 00

This is the pointer to the data structure but it is stored as little endian. So I cannot simply copy the address. I have to transform it by hand into:

000000005EFCC421

Is there a common and easy way to handle these situations? I am currently using x64dbg as a debugger. Thanks!

1

Normally there should be an option “display as dwords” or similar for the memory dump

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.