I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered):

cmp byte ptr ds:[eax+0x15FC], 0x0

If I normally load the .exe and try to go to the address which was eax + 0x15FC, it obviously won't find it. But if I let it run until it comes to the compare, it will find the address in the dump with a value of 0.

So now to my question: How am I able to break when the address gets used or something writes to it?

I already tried setting a Hardware Breakpoint to eax + 0x15FC which did not get triggered.

BTW my goal is to find the location where eax + 0x15FC gets set to 0.

Thanks in advance for the answers!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.