Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 05-25-2009, 03:31 AM
kapalua kapalua is offline
Junior Member
 
Join Date: May 2009
Posts: 2
Default Can't find memory location 0012F6F4

Hi,

I'm trying to re an application that finds deleted data in order to learn how this is done. I'm running XP and using OllyDbg.
The program calls the Win32 function Readfile() and specifies a memory address ,which is 0012F6F4, that is supposed to point to a overlapped(http://msdn.microsoft.com/en-us/libr...42(VS.85).aspx) structure which holds the offset to read etc.
But i can't find that memory location in the memory window or anything. I'm i searching in the wrong place?

PS:
Maybe needless to say but this is my first "real" re task = i'm a noob.
Reply With Quote
  #2  
Old 05-25-2009, 04:36 AM
kiki kiki is offline
Senior Member
 
Join Date: Jun 2007
Posts: 186
Default

Quote:
Originally Posted by kapalua View Post
Hi,
PS:
Maybe needless to say but this is my first "real" re task = i'm a noob.
please learn how to use your tools, it will help you much to complete your task in RE
Reply With Quote
  #3  
Old 05-25-2009, 03:40 PM
kapalua kapalua is offline
Junior Member
 
Join Date: May 2009
Posts: 2
Default

Hmm..how could i miss the window in the lower right corner of ollydbg?
Thanks for the tip.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2022, Jelsoft Enterprises Ltd.