Finding ECX origin

[slointe]

This one has been bugging
me

Code: Select all

1EF845DE   CC               INT3
1EF845DF   CC               INT3
1EF845E0   51               PUSH ECX ; Where do I originate?
1EF845E1   D981 D80A0000    FLD DWORD PTR DS:[ECX+AD8]  ; ECX is what I want but it's dynamic         
1EF845E7   51               PUSH ECX
1EF845E8   D889 D40A0000    FMUL DWORD PTR DS:[ECX+AD4]
1EF845EE   D95C24 04        FSTP DWORD PTR SS:[ESP+4]
1EF845F2   D94424 04        FLD DWORD PTR SS:[ESP+4]
1EF845F6   D91C24           FSTP DWORD PTR SS:[ESP]
1EF845F9   E8 F285FDFF      CALL gamex86.1EF5CBF0
1EF845FE   83C4 08          ADD ESP,8
1EF84601   C3               RETN
1EF84602   CC               INT3


How do I go about finding what populates the PUSH ECX?

[mezzo]

dunno if this will work, but how about injecting code at 1EF845E1
and doing a pop, then writing the value somewhere in a 'temp' ramlocation and pushing it again ?

[L. Spiro]

How do I go about finding what populates the PUSH ECX?

I assume you mean what set ECX.

Go to the function that called this function and look for the code that set ECX.


L. Spiro

[slointe]

How do I go about finding what populates the PUSH ECX?

I assume you mean what set ECX.

Go to the function that called this function and look for the code that set ECX.


L. Spiro

So the function that is setting this ECX would be calling this function something like "call 1EF845E0"? The address of the PUSH command?

[L. Spiro]

The address of the PUSH command?

I have no idea what this is doing in your sentence.



Go to the function that called this function by stepping to the RET at the end of this function.
You go to an instruction after CALL 1EF845E0.

Above that there is MOV ECX, <something>.


Follow the code to figure out what set ECX.


L. Spiro

[slointe]

Does whoever call this function:

Code: Select all

1EF845DE   CC               INT3
1EF845DF   CC               INT3
1EF845E0   51               PUSH ECX ; Where do I originate?
1EF845E1   D981 D80A0000    FLD DWORD PTR DS:[ECX+AD8]  ; ECX is what I want but it's dynamic         
1EF845E7   51               PUSH ECX
1EF845E8   D889 D40A0000    FMUL DWORD PTR DS:[ECX+AD4]
1EF845EE   D95C24 04        FSTP DWORD PTR SS:[ESP+4]
1EF845F2   D94424 04        FLD DWORD PTR SS:[ESP+4]
1EF845F6   D91C24           FSTP DWORD PTR SS:[ESP]
1EF845F9   E8 F285FDFF      CALL gamex86.1EF5CBF0
1EF845FE   83C4 08          ADD ESP,8
1EF84601   C3               RETN
1EF84602   CC               INT3


Call it by this address?:

Code: Select all

1EF845E0



[L. Spiro]

Probably.


L. Spiro

[slointe]

That's what I thought. I set a BP on it and all I see is the ECX value and not who calls it.

Got it now. Thanks!