Re: How to detect strings occurences

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

you may found location of that string in memory and set breakpoint for
accessing that memory (in SoftIce)

hope this helps

--
Vladimir Scherbina

"Jacky Luk" <jl@xxxxxxxxxx> wrote in message
news:uWF7S0mcFHA.2124@xxxxxxxxxxxxxxxxxxxxxxx
> Hi,
> This is not quite a kernel question. But I think you guys might know about
> this question more in general.
> My question is.... that essentially, what is the technique to detect a
> string such as "hello world" has been accessed in anyway and set a
> breakpoint on that instruction?
> For example
> lea ecx, [eax]
> eax contains the address of the variable and [eax] returns the pointer of
> it.
> then when ecx is pointing to "hello world!", then the debugger should stop
> and let me inspect the code. Is it possible? I do think it might involve
> emulation. Thanks
> Jack
>
>


.

Relevant Pages

  • Re: I suppose the idea of classes and inheritance is
    ... And in order to get to that null character, you needed to index past the end of the string. ... When the memory manager allocates memory from a string, the memory comes from a larger block of memory. ... dec eax ...
    (alt.comp.lang.borland-delphi)
  • Re: again, external symbols in hla
    ... > mov (eax, a); ... in a dword, but if the string is longer, the special case fails. ... and watch your memory. ...
    (alt.lang.asm)
  • Re: MASD syntax to load the current address in C.A at runtime
    ... so my memory on A=PC is not as good. ... CODE object, the CRC on the CODE object will change. ... easier to store individual pieces as the time string was built. ...
    (comp.sys.hp48)
  • Re: Fast string operations
    ... Looping: I thought looping over arrays in managed code was "slow" ... array handling and such. ... The problem with TrimHelper is that it always returns a new string instance. ... The customer perceives this as a memory leak. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Discovering variable types...
    ... >- but I suppose MS expect us to use wrappers ... memory allocations for your variables from disk as well. ... >They most certainly are of fixed size, changing the size of a String ... >>me to keep buffer size and current postion right in the memory block. ...
    (comp.lang.pascal.delphi.misc)