Question about displaying actual data

[Sanek]

Hi,

I'm really impressed with this software, its easy to use and yet its so powerful at the same time.

I'm still trying to figure some parts out.

I know the memory address that contains the address of a pointer that points to a variable that contains an unsigned long value.

So its basically something like this:
0xAAAAAAAA(static pointer) -> 0xBBBBBBBB(dynamic pointer) -> variable

I would like to monitor this structure with MHS, but I'm not sure what the best way to do this is?

I would really like if I could add something like

New Value

Code: Select all

Desc.:   ppData
Address: AAAAAAAA
Type:    pointer

to the address list, then do something like

New Value

Code: Select all

Desc.:   pData
Address: ppData
Type:    pointer

and then do something like

New Value

Code: Select all

Desc.:   Data
Address: pData
Type:    unsigned long

To use the address stored in the pointer itself, but I'm not sure if you can do this atm?

TIA!

[L. Spiro]

If you only want to see the unsigned long as it moves around in memory you only need one Stored Value.

View the Address Modifications page in the help file along with the Expression Evaluator page.


All you need to do is create a Complex Address that goes to the unsigned long.

The format is:

Code: Select all

[[0xAAAAAAAA]+0]+0

The +0’s are there for completeness but you can remove them if there are no offsets from the pointer targets. If there are offsets, you can replace the 0’s with the offsets.

Looking at the Modify Address dialog on the Normal Address page, paste the above code into the Complex field and check the Use Complex Address check.



Read about Expressions to understand how to make any more addresses you need.


L. Spiro

[Sanek]

If you only want to see the unsigned long as it moves around in memory you only need one Stored Value.

View the Address Modifications page in the help file along with the Expression Evaluator page.


All you need to do is create a Complex Address that goes to the unsigned long.

The format is:

Code: Select all

[[0xAAAAAAAA]+0]+0

The +0’s are there for completeness but you can remove them if there are no offsets from the pointer targets. If there are offsets, you can replace the 0’s with the offsets.

Looking at the Modify Address dialog on the Normal Address page, paste the above code into the Complex field and check the Use Complex Address check.



Read about Expressions to understand how to make any more addresses you need.


L. Spiro

Ahh, worked perfectly.

Thank you!