blabberer
February 5th, 2003, 05:50
homunculuswell when you are using debugger you have to try something for yourself too
anyway here is how you can do it
00401000 > $ 6A 00 PUSH 0 ; /pModule = NULL
00401002 . E8 DF010000 CALL 004011E6 ; \GetModuleHandleA
f7 here
00401007 . A3 A0314000 MOV DWORD PTR DS:[4031A0], EAX
come here
and end up here
004011E6 FF25 14204000 JMP NEAR DWORD PTR DS:[402014];KERNEL32.GetModuleHandleA
now click debug or use CTRL+T
check mark the EIP is in Range CheckBox
enter 401005 in the from edit box |<----- dont ask me where is from or to edit
enter 401010 in the to edit box | box i have named them so
press ok
press CTRL+F12
the debugger stops at 401007 with the message
conditional pause: EIP in range 401005...401010
this debugger is a great tool devote some time and learn the intricacies of it
it will be very very usefull just shooting out questions wont help (dont misunderstand me i say this as a matter of fact)