Hot answers tagged


Firstly, let's understand what goes into edx. edx contains the first argument passed to this function which is a pointer the data that we want to compute its MD5 hash. Looking at images, stack frame of the current function is like: esp + 0x0 --> | local_var_8 | esp + 0x4 --> | local_var_4 | esp + 0x8 --> | return_addr | esp + 0xC --> | arg_0 ...


It might be useful to check the command line that was used to start the program. Open the Details tab of Task Manager and right click on any column (Name/PID/status). Then choose "Select columns" and in the new window scroll down and check the "Command line" box (below the I/O ones).


This is called Virtual Machine Introspection (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead of relying on the built-in OS support (such as used by WinDbg kernel debugger). You can check for an example of how it could be done using IDA over VMWare's ...

Only top voted, non community-wiki answers of a minimum length are eligible