0

I'am a newbie of IDA and after disassably a file I get this error on some subroutine:

"write access to const memory has been detected"

// write access to const memory has been detected, the output may be wrong!
_BYTE *__thiscall sub_49D020(_BYTE *this, int a2, int a3, int a4, int a5)
{
  _BYTE *v5; // esi

  v5 = this;
  sub_45C210(a2, a3, a4, a5);
  *(_DWORD *)v5 = &off_4DE648;
  ++dword_5BB8D4;
  v5[68] = 1;
  if ( dword_5BBDD0 )
  {
    if ( dword_5BBD70 )
      sub_41CBE0();
    sub_485810(*(_DWORD *)(dword_5BBDD0 + 28));
  }
  return v5;
}




.text:0049D020 ; =============== S U B R O U T I N E =======================================
.text:0049D020
.text:0049D020
.text:0049D020 sub_49D020      proc near               ; CODE XREF: sub_412400+35↑p
.text:0049D020                                         ; sub_42A080+34↑p ...
.text:0049D020
.text:0049D020 var_10          = dword ptr -10h
.text:0049D020 var_C           = dword ptr -0Ch
.text:0049D020 var_4           = dword ptr -4
.text:0049D020 arg_0           = dword ptr  4
.text:0049D020 arg_4           = dword ptr  8
.text:0049D020 arg_8           = dword ptr  0Ch
.text:0049D020 arg_C           = dword ptr  10h
.text:0049D020
.text:0049D020 ; FUNCTION CHUNK AT .text:004D9650 SIZE 00000008 BYTES
.text:0049D020
.text:0049D020                 push    0FFFFFFFFh
.text:0049D022                 push    offset SEH_49D020
.text:0049D027                 mov     eax, large fs:0
.text:0049D02D                 push    eax
.text:0049D02E                 mov     large fs:0, esp
.text:0049D035                 push    ecx
.text:0049D036                 mov     eax, [esp+10h+arg_C]
.text:0049D03A                 mov     edx, [esp+10h+arg_4]
.text:0049D03E                 push    esi
.text:0049D03F                 mov     esi, ecx
.text:0049D041                 mov     ecx, [esp+14h+arg_8]
.text:0049D045                 push    eax
.text:0049D046                 mov     eax, [esp+18h+arg_0]
.text:0049D04A                 push    ecx
.text:0049D04B                 push    edx
.text:0049D04C                 push    eax
.text:0049D04D                 mov     ecx, esi
.text:0049D04F                 mov     [esp+24h+var_10], esi
.text:0049D053                 call    sub_45C210
.text:0049D058                 mov     dword ptr [esi], offset off_4DE648
.text:0049D05E                 mov     ecx, dword_5BB8D4
.text:0049D064                 inc     ecx
.text:0049D065                 mov     [esp+14h+var_4], 0
.text:0049D06D                 mov     dword_5BB8D4, ecx
.text:0049D073                 mov     byte ptr [esi+44h], 1
.text:0049D077                 mov     eax, dword_5BBDD0
.text:0049D07C                 test    eax, eax
.text:0049D07E                 jz      short loc_49D09D
.text:0049D080                 mov     ecx, dword_5BBD70
.text:0049D086                 test    ecx, ecx
.text:0049D088                 jz      short loc_49D08F
.text:0049D08A                 call    sub_41CBE0
.text:0049D08F
.text:0049D08F loc_49D08F:                             ; CODE XREF: sub_49D020+68↑j
.text:0049D08F                 mov     ecx, dword_5BBDD0
.text:0049D095                 mov     ecx, [ecx+1Ch]
.text:0049D098                 call    sub_485810
.text:0049D09D
.text:0049D09D loc_49D09D:                             ; CODE XREF: sub_49D020+5E↑j
.text:0049D09D                 mov     ecx, [esp+14h+var_C]
.text:0049D0A1                 mov     eax, esi
.text:0049D0A3                 mov     large fs:0, ecx
.text:0049D0AA                 pop     esi
.text:0049D0AB                 add     esp, 10h
.text:0049D0AE                 retn    10h
.text:0049D0AE sub_49D020      endp

Can you please help me to solve this problem ?

Thanks !

2
  • What are the addresses mentioned in Output window?
    – Igor Skochinsky
    Jan 28, 2021 at 16:55
  • In what segment is dword_5BB8D4 situated?
    – Igor Skochinsky
    Jan 28, 2021 at 16:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.