开发者

netapi32.dll - searching for certain instruction

开发者 https://www.devze.com 2023-02-19 22:46 出处:网络
I\'m trying to figure out how the Unhandled Exception Filter heap overflow works. I pretty much know what is supposed to happen, but I need to find the instruction开发者_如何学Go \"call dword ptr[edi+

I'm trying to figure out how the Unhandled Exception Filter heap overflow works. I pretty much know what is supposed to happen, but I need to find the instruction开发者_如何学Go "call dword ptr[edi+0x78]" in netapi32.dll.

Can you help me find that instruction. I tried to use ollydbg, I Loaded the netapi32.dll and searched for a command, then inputted "call dword ptr[edi+0x78]", but nothing.

Is there more effective way for searching such instructions?


The problem with ollydbg is that whenever searching for a command you have to type exactly as the debugger presents the command (no regular expressions allowed). This is the line that I used:

call dword ptr ds:[edi+78]

it works now.

0

精彩评论

暂无评论...
验证码 换一张
取 消