Finding base address in a remote process

[Nacho_dj]

In fact, in assembler instructions it is quite difficult to decide if you are facing a procedure or a function.

But you could follow this approach: if the EAX value after the return of the CALL is used immediately in the code, it should be a function, and if the EAX value is ignored after that return, you could think of it as a procedure...

Normally, this should work if you are reversing code to a higher level of programming.

Cheers

Nacho_dj

Yes, if the application is written in a high level language ... but if it is not ...

yaa