0

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond.

ScreenShot:

I did a hardware breakpoint on that line MOV ecx, [DOSBox.exe+210BF4].
When the turn comes to that line, this memory address DOSBox.exe+210BF4 becomes holder to the target value and then the ECX register takes that value from it.

I am sure that the target value comes from this address but I don't know how can I get the value from that strange address. Is there a solution?

14
  • 1
    How about a hardware breakpoint on the memory location? That will stop the program and enter the debugger whenever the location is changed. Commented Jun 8, 2021 at 16:32
  • If the value is really changing so often then (without a proper synchronization) the code also doesn't know what value it will get. Assuming the values follow a pattern it might be an anti-debugging measure. By reading it's value multiple times one could try to assume the execution time and thus detect a debugger.
    – Robert
    Commented Jun 8, 2021 at 16:45
  • @BrendanDolan-Gavitt: I have updated my question, and I have answered your words.
    – Lion King
    Commented Jun 8, 2021 at 18:01
  • @Robert: Unfortunately, this matter is not easy to predict, and one must know the mechanism to that pattern, although that game is very old from the dos era.
    – Lion King
    Commented Jun 8, 2021 at 18:11
  • no hwbp on mov ecx , line set hwbp on like (windbg syntax) ba w1 DOSBox.exe+210BF4 it should stop when someone writes to that location then look at the call stack kb in windbg
    – blabb
    Commented Jun 8, 2021 at 18:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.