|
for the advance:
the method is correct, but somehow it
didn't catch the bp, it erased the breakpoint, but eventhough I brought it
back it still wouldn't catch it, you can work around it by the following:
you will notice when you passed the pushad
that esp = 12 ffa4 , it should have poped up
when it has been accessed, but it did not , so once you are at the last exception, set trace condition esp==
12ffa4, then control+f11 it will stop on top of the stolen byte as it should have, f7 little bit you should be at the first one.
Last edited by britedream; 01-17-2004 at 02:14.
|