Posted: Sun May 08, 2016 8:50 am Post subject: Break and Trace Condition
I am trying to break and trace some code which is used for multiple things.
So I want to trace it in a special condition I need.
In my case this is ECX==0x145E4168 - for example.
The break+trace window offers only a STOP condition, but that's not what i need. This way I get all kinds of traces, but not for the case I need it for.
Is there a way to start the trace only if the given register has the required value? _________________
This text has been encrypted with XOR twice for security reasons.
I normally just write an injection script to do that.
Code:
newmem:
cmp ecx,145E4168
jne code
nop // set breakpoint here
code:
//regular instruction
jmp return
INJECT:
jmp newmem // make sure it jumps to your compare
return:
I normally just write an injection script to do that.
Code:
newmem:
cmp ecx,145E4168
jne code
nop // set breakpoint here
code:
//regular instruction
jmp return
INJECT:
jmp newmem // make sure it jumps to your compare
return:
This idea I had in mind too, but maybe there is a more practical way I dont know yet.
Thanks to both for your answers _________________
This text has been encrypted with XOR twice for security reasons.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum