Moderators: g3nuin3, SpeedWing, WhiteHat, mezzo
JB Gzn wrote:if you want to use the find out what writes to this address,
do it on the ORIGINAL addy, not on a pointer,
then make the value change( walk)
and u will get some stuff in the list
L. Spiro wrote:Would it kill you to look through 15 results?
You can filter them out just as you can with any other search set…
Especially with 2 MHS’s at the same time.
L. Spiro
liqmysaq wrote:u will need to search again using the new address. so do another pointer search for 07F607A8. now in the expression eval u edit your complex address so it would look like this:
[[0xNewAddyFound]+0xNewOffset]+0x4B4 and press the + button to add it to the lower window. keep doing that until u come to an address that is green in the found addresses list and there is your complete complex pointer. it can take a while in some cases and go pretty deep.
Users browsing this forum: No registered users and 0 guests