请教变量断点如何下
014CDC35|.8B40 34 mov eax,dword ptr ds:014CDC38 85C0 test eax,eax
014CDC3A 74 0A je XMas.014CDC46
014CDC3C 8378 1C 00 cmp dword ptr ds:,0x0 ========这里比较: 和 0 （这个 是变量，每次重启后地址不一样。所以下硬件断点，断不住）
014CDC40 0F85 54010000 jnz Mas.014CDD9A ===================关键跳
014CDC46|>8B83 B8070000 mov eax,dword ptr ds:
014CDC4C|.8B48 38 mov ecx,dword ptr ds:
014CDC4F|.E8 1C880B00 call Mas.01586470==================弹出错误
========================================================================================
特向前辈请教，如果我想知道是谁给这个变量赋了0的值，什么时候赋的。这个应该如果下断？（请注意 这个地址重启会变哦） 没其他参考了？情报太少了。 冥界3大法王 发表于 2023-4-26 09:15
没其他参考了？情报太少了。
014CDB20/$55 push ebp
014CDB21|.8BEC mov ebp,esp
014CDB23|.81EC 1C030000 sub esp,0x31C
014CDB29|.A1 38F41102 mov eax,dword ptr ds:
014CDB2E|.33C5 xor eax,ebp
014CDB30|.8945 FC mov ,eax
014CDB33|.A1 E0641202 mov eax,dword ptr ds:
014CDB38|.53 push ebx
014CDB39|.D1E8 shr eax,1
014CDB3B|.8BD9 mov ebx,ecx
014CDB3D|.8995 5CFDFFFF mov ,edx
014CDB43|.899D 80FDFFFF mov ,ebx
014CDB49|.C785 60FDFFFF>mov ,0x0
014CDB53|.56 push esi
014CDB54|.57 push edi
014CDB55|.A8 01 test al,0x1
014CDB57|.0F84 CC000000 je MasterPD.014CDC29
014CDB5D|.8B0B mov ecx,dword ptr ds:
014CDB5F|.85C9 test ecx,ecx
014CDB61|.0F84 C2000000 je MasterPD.014CDC29
014CDB67|.8B01 mov eax,dword ptr ds:
014CDB69|.FF50 04 call dword ptr ds:
014CDB6C|.8B0D DC7F1702 mov ecx,dword ptr ds:
014CDB72|.33F6 xor esi,esi
014CDB74|.89B5 64FDFFFF mov ,esi
014CDB7A|.8BF8 mov edi,eax
014CDB7C|.89BD 6CFDFFFF mov ,edi
014CDB82|.85C9 test ecx,ecx
014CDB84|.74 2D je XMasterPD.014CDBB3
014CDB86|.E8 85583B00 call MasterPD.01883410
014CDB8B|.8BF8 mov edi,eax
014CDB8D|.56 push esi
014CDB8E|.89BD 6CFDFFFF mov ,edi
014CDB94|.E8 15595A00 call MasterPD.01A734AE
014CDB99|.83C4 04 add esp,0x4
014CDB9C|.8BF7 mov esi,edi
014CDB9E|.89B5 64FDFFFF mov ,esi
014CDBA4|.85FF test edi,edi
014CDBA6|.75 0F jnz XMasterPD.014CDBB7
014CDBA8|.BF 902A0102 mov edi,MasterPD.02012A90 ;filename
014CDBAD|.89BD 6CFDFFFF mov ,edi
014CDBB3|>85FF test edi,edi
014CDBB5|.74 69 je XMasterPD.014CDC20
014CDBB7|>8B0B mov ecx,dword ptr ds:
014CDBB9|.85C9 test ecx,ecx
014CDBBB|.74 26 je XMasterPD.014CDBE3
014CDBBD|.8B01 mov eax,dword ptr ds:
014CDBBF|.FF90 8C000000 call dword ptr ds:
014CDBC5|.85C0 test eax,eax
014CDBC7|.74 1A je XMasterPD.014CDBE3
014CDBC9|.8B0B mov ecx,dword ptr ds:
014CDBCB|.85C9 test ecx,ecx
014CDBCD|.74 0D je XMasterPD.014CDBDC
014CDBCF|.8B01 mov eax,dword ptr ds:
014CDBD1|.FF90 8C000000 call dword ptr ds:
014CDBD7|.8B78 28 mov edi,dword ptr ds:
014CDBDA|.EB 09 jmp XMasterPD.014CDBE5
014CDBDC|>33C0 xor eax,eax
014CDBDE|.8B78 28 mov edi,dword ptr ds:
014CDBE1|.EB 02 jmp XMasterPD.014CDBE5
014CDBE3|>33FF xor edi,edi
014CDBE5|>89BD 74FDFFFF mov ,edi
014CDBEB|.85FF test edi,edi
014CDBED|.0F84 C5010000 je MasterPD.014CDDB8
014CDBF3|.8B07 mov eax,dword ptr ds:
014CDBF5|.8BCF mov ecx,edi
014CDBF7|.8B80 E4020000 mov eax,dword ptr ds:
014CDBFD|.FFD0 call eax
014CDBFF|.84C0 test al,al
014CDC01|.0F84 93010000 je MasterPD.014CDD9A
014CDC07|.E8 1410E0FF call MasterPD.012CEC20
014CDC0C|.8378 54 00 cmp dword ptr ds:,0x0
014CDC10|.75 1E jnz XMasterPD.014CDC30
014CDC12|.8B8B B8070000 mov ecx,dword ptr ds:
014CDC18|.8B49 38 mov ecx,dword ptr ds:
014CDC1B|.E8 2001FEFF call MasterPD.014ADD40
014CDC20|>56 push esi
014CDC21|.E8 88585A00 call MasterPD.01A734AE
014CDC26|.83C4 04 add esp,0x4
014CDC29|>33C0 xor eax,eax
014CDC2B|.E9 C10D0000 jmp MasterPD.014CE9F1
014CDC30|>E8 EB0FE0FF call MasterPD.012CEC20
014CDC35|.8B40 34 mov eax,dword ptr ds:
014CDC38 85C0 test eax,eax
014CDC3A 74 0A je XMasterPD.014CDC46
014CDC3C 8378 1C 00 cmp dword ptr ds:,0x0 ======比较
014CDC40 0F85 54010000 jnz MasterPD.014CDD9A ==========关键跳
014CDC46|>8B83 B8070000 mov eax,dword ptr ds:
014CDC4C|.8B48 38 mov ecx,dword ptr ds:
014CDC4F|.E8 1C880B00 call MasterPD.01586470 ;弹出错误
这伙无外乎指针，往上追踪eax……
好像可以右键，查找参考…… 无闻无问 发表于 2023-4-26 09:25
这伙无外乎指针，往上追踪eax……
好像可以右键，查找参考……
那出来的太多了，也分不出来是谁给他赋0啦。 situhaonan 发表于 2023-4-26 09:35
那出来的太多了，也分不出来是谁给他赋0啦。
右键，查找参考，或查找引用，试没试？ 本帖最后由 冥界3大法王 于 2023-4-26 10:41 编辑
situhaonan 发表于 2023-4-26 09:35
那出来的太多了，也分不出来是谁给他赋0啦。
编个脚本，统统条件跟踪日志伺候，统统输出寄存器值。。。再筛选复合满足的。。 situhaonan 发表于 2023-4-26 09:35
那出来的太多了，也分不出来是谁给他赋0啦。
多吗？那你筛选赋值的，应该就不多，再下断点…… 014CDC3C 8378 1C 00 cmp dword ptr ds:,0x0 ======比较
寄存器的值不好改可以改后面的0x0啊
页:
[1]