Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #16  
Old 02-08-2006, 02:18
Sarge
 
Posts: n/a
Hmmm, remember that Variants are structures, the read/write address indicated by the stack parameter is the
address of the structure, not the data IN the structure.

Also, I can't reconcile your statements:

"I'm on the above instruction in WKT and top of Stack shows:

0012E4D0: 68E81200 284B6500

Looking at 0012E868 supplies 02000000 and looking at 00654B28 supplies 08001200"

I assume that the value "68E81200" is the top-of-stack, and that "284B6500" is the next-to-top-of-stack? If so, go
to those two addresses, find the Variant structures, then find the numeric values represented by those structures, and
multiply them. Then, store the result in the local Frame in the location indicated by the offset that is Parameter #1. (This IS explained in the text I have posted.)

I don't see where "0012E868" and "00654B28" come from. Of course, I am not very familiar with the "Whiskey-with-Tequila" debugger's syntax.

If this is not a correct analysis, it's because (as I said), I don't see where the data you have indicated comes from.

Sarge
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VB6 N-CODE - Stop any servive and Start any APP-Release and Source Code wilson bibe General Discussion 5 04-10-2013 00:23
Code Splicing Problem TmC General Discussion 1 11-14-2006 21:23
Code to efficiently break on entering code section??? yaa General Discussion 4 05-08-2005 05:29


All times are GMT +8. The time now is 00:56.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )