Search Results
Search type | Search syntax |
---|---|
Tags | [tag] |
Exact | "words here" |
Author |
user:1234 user:me (yours) |
Score |
score:3 (3+) score:0 (none) |
Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
Views | views:250 |
Code | code:"if (foo != bar)" |
Sections |
title:apples body:"apples oranges" |
URL | url:"*.example.com" |
Saves | in:saves |
Status |
closed:yes duplicate:no migrated:no wiki:no |
Types |
is:question is:answer |
Exclude |
-[tag] -apples |
For more details on advanced search visit our help page |
1
vote
Access violation error only when stepping after breakpoint in Immunity
As @guntram-blohm suggested, "Used jmp esp instead of pop esp; retn" is likely a problem.
pop esp; retn effectively does the following, which is very different from jmp esp:
mov esp, dword ptr [esp] …
1
vote
Accepted
Memory activity tracking
As you noted, PIN would likely be the best option for this. Since PIN allows you to register user-defined callbacks for events, you could indeed record timestamps via your callback functions.
You may …
2
votes
Accepted
Ollydbg:how to let Olly remember a breakpoint for next run
There are a couple of plugins designed to fix this in v1 (such as Breakpoint Manager), but the better solution is to upgrade to OllyDbg v2. …
0
votes
Accepted
Breaking on specific API
Set a hardware-read breakpoint on the corresponding index in the AddressOfFunctions array from advapi32.dll's IMAGE_EXPORT_DIRECTORY. … When the hardware breakpoint gets hit, examine the callstack to see if the address of RegQueryValueExA was being resolved by code in your target module. …
2
votes
Analyze a created thread after main thread
Why I can not set the BP ?
The warning message in the screenshot is telling you that you can set the BP.