Results 1 to 2 of 2

Thread: strange program behaviour

  1. #1

    strange program behaviour

    Hi to all,
    well i've a little probl with a prog
    well i'd like to know where in the code that prog writes
    in a runtime allocated mem a string
    Think that mem is allocated via VirtualAlloc() coz its not surely
    stack mem and neither heap mem (coz i bpx heapalloc()
    and i dont see the prog allocating heap in that mem region,
    and heapalloc() should call VirtualAlloc() if i'm right)
    so bpx VirtualAlloc() i should find where the prog allocates
    that mem region and when i see it has just allocated the mem i'm able to put bpm on it
    The probl is that i'm not able to see when the mem is allocated !!!
    Sice pops many times demostrating the prog calls various times
    the VirtualAlloc() to allocate mem before the mem region i'm interested in and suddenly i found a VirtualAlloc() call
    over the mem region i'm interested in and i can see
    the page i'm interested in thats already been allocated and the str is already inside it
    How is it possible ?

    Tnx in advance
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Hi to all,
    well i've just solved the probl by myself
    There was a MMF instead of a mem allocation routine
    The str was in a file that was opened and shared with mmf
    and so the prog was able to read the str directly from the memory

    See ya
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Armadillo App strange Mem-behaviour ?
    By SKiLLa in forum OllyDbg Support Forums
    Replies: 2
    Last Post: October 18th, 2005, 15:37
  2. SoftIce strange behaviour
    By robson in forum The Newbie Forum
    Replies: 13
    Last Post: December 25th, 2004, 21:50
  3. Very strange behaviour
    By Firestream in forum Bugs
    Replies: 3
    Last Post: January 15th, 2003, 10:34
  4. Odd softice behaviour
    By matthew in forum Malware Analysis and Unpacking Forum
    Replies: 1
    Last Post: December 17th, 2001, 12:26
  5. quite strange app behaviour
    By NikDH in forum Advanced Reversing and Programming
    Replies: 2
    Last Post: February 7th, 2001, 06:47


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts