Categories > Coding > C++ >

Is this the right address?

Posts: 2014

Threads: 198

Joined: Apr, 2021

Reputation: 16

Posted

Is this the right address for print?

0x003641B7

 

I'm stupid, yes, and tired, so if I forgot about something, please remind me. (Rebased to 0x0 ofc)

  • 0

Random quote here...

Posts: 24

Threads: 0

Joined: Dec, 2022

Reputation: 5

Replied

no, this is the address of one of the places where the print function is called

specifically, the address of a PUSH instruction which pushes a pointer to the string "Video recording stopped", onto the stack

after this, the number 1 is pushed onto the stack (1 means blue print), then the print function is called using the CALL instruction

after the call, the print function will take both of these arguments off the stack and do the appropriate printing with them

so, if you want to emulate this printing that occurs at 0x003641B7, you want the address of the function, so you can call it yourself

the address is 0x00C7ACC0 and you can see it at the CALL instruction at 0x003641BE

 

IDA automatically names the function sub_C7ACC0, because the function is located at C7ACC0 in memory

you should right click on sub_C7ACC0, then rename it to "print" or "output" or something that makes it easier for you to understand

  • 0

Users viewing this thread:

( Members: 0, Guests: 1, Total: 1 )