Extract value from address

Des suggestions, questions et critiques à propos du site ou du forum.

Extract value from address

Messagepar evilkid » 22 Août 2016, 03:14

Bonjour,

I'm trying to reverse engineer an application made in vb6, at a certain point it compares an input number to a constant number, my goal here is to extract that number, now i found where the comparison is taken place:

Code: Tout sélectionner
FCOMP QWORD PTR DS:[402CB0]

Image
Now i understand that FCOMP Compares the contents of register ST(0) and source value.I dont know if i got this right, but from what i've read DS:[402CB0] is pointer to an address thats holding the source value, but using OllyBG, and while navigating to that address (Ctrl + g), i found out that the value is "DB 00" which is not correct enter image description here

so my question here is how can i find the real value that is being compared? and is it possible to make the FCOMP compares to a constant to a pointer of an address?

Merci :)
evilkid
 
Messages: 1
Inscription: 22 Août 2016, 03:13

Re: Extract value from address

Messagepar etherlord » 22 Août 2016, 07:18

Well, difficult to say with only one line of code......

FCOMP is designed to compare floating point values.

Are you sure your program does not make single use of C0, C2 and C3 and maybe the value in memory is correct ?

Compares the contents of register ST(0) and source value and sets condition code flags C0, C2, and C3 in the FPU status word according to the resu



The FCOMP instruction pops the register stack following the comparison operation . To pop the register stack, the processor marks the ST(0) register as empty and increments the stack pointer (TOP) by 1.


etherlord
etherlord
Triumvirat
Triumvirat
 
Messages: 2551
Inscription: 22 Mars 2004, 16:12


Retourner vers Deamon Crack & Forum Crack

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 3 invités