How to find out what sets the ESP-Register, please HELP!!!

[Steiner]

Hi,
I got a little problem to find the right complex address. Ok here is the problem:
- In use ollydbg to trace down some routing of a game
- after some pointers the value I need to find out is stored in the spackpointer(esp)

How can I find the root, where esp is set?


Greetz Tobi.

[Sychotix]

find something such as mov esp, [esi+10] as close to the address (up of course...) as you can find.

[Steiner]

Sure, but I can't find something like this. Only sub esp, xx.

[L. Spiro]

Why do you need to know how ESP is set? There is no reason for knowing this.
It is set by every PUSH, POP, CALL, RET, and RETN in the code, and sometimes MOV and SUB.

It is impossible to use this information constructively; find another path for whatever you are trying to do.


L. Spiro

[Steiner]

I'm trying to find a complex address, but I must pause my work, because I can't going on. This is my current result:
[[[[ESP]+0x28]+0x14]+0x78]+0x04

I believe there is no other way, because I watch the value in memory dump, it's change only when this path was taken.


Greetz Tobi.

[Steiner]

I don't know whether it helps, but the value of esp does not change, it keeps every time 0x0012FAF0. Hm?

[L. Spiro]

ESP is on the stack. The stack is a pile of temporary constantly changing data. At any given time, any value on the stack may be anything and have been set by any function. All functions on the thread use the stack, and they all share it for all of their temporary data.

Imagine a pile of garbage with things constantly being added to the top and things constantly rolling down the side. At one position on the heap, at one time, you may find what you want, but it is quickly covered by something else rolling down the hill. It may appear and reappear, but it may not be at the same location, and it will always disappear.

You can not use anything on the stack for any purpose. It is garbage.



There is only one exception, that being a “CGame” class declared on the stack, or a pointer to such a class declared on the stack, as is done with Nintendo DS games. For example:

Code: Select all

int main() {
    CGame * pgGame = new CGame();

    pgGame->Run();

    return 0;
}

But you really need to verify yourself whether this is the case, and whether it is or not does not matter; you have no reliable way of getting the offset into the stack of the object.


L. Spiro

[Steiner]

Hmpf, but all what I want is the static addresses of the hero positions of all players in Warcraft3. I try so hard but can't find it... Maybe you can help me to find them?