Skip to main content
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Code code:"if (foo != bar)"
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Saves in:saves
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with
Search options answers only not deleted user 1562
1 vote

Access violation error only when stepping after breakpoint in Immunity

As @guntram-blohm suggested, "Used jmp esp instead of pop esp; retn" is likely a problem. pop esp; retn effectively does the following, which is very different from jmp esp: mov esp, dword ptr [esp] …
Jason Geffner's user avatar
1 vote
Accepted

Memory activity tracking

As you noted, PIN would likely be the best option for this. Since PIN allows you to register user-defined callbacks for events, you could indeed record timestamps via your callback functions. You may …
Jason Geffner's user avatar
2 votes
Accepted

Ollydbg:how to let Olly remember a breakpoint for next run

There are a couple of plugins designed to fix this in v1 (such as Breakpoint Manager), but the better solution is to upgrade to OllyDbg v2. …
Jason Geffner's user avatar
0 votes
Accepted

Breaking on specific API

Set a hardware-read breakpoint on the corresponding index in the AddressOfFunctions array from advapi32.dll's IMAGE_EXPORT_DIRECTORY. … When the hardware breakpoint gets hit, examine the callstack to see if the address of RegQueryValueExA was being resolved by code in your target module. …
Jason Geffner's user avatar
2 votes

Analyze a created thread after main thread

Why I can not set the BP ? The warning message in the screenshot is telling you that you can set the BP.
Jason Geffner's user avatar