Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 05-14-2013, 03:09
Naides Naides is offline
Friend
 
Join Date: Mar 2005
Location: Planet Earth
Posts: 40
Rept. Given: 7
Rept. Rcvd 2 Times in 1 Post
Thanks Given: 21
Thanks Rcvd at 10 Times in 7 Posts
Naides Reputation: 2
Quote:
Originally Posted by BlackWhite View Post


[esp+4] is actually hWND which is ready to process the current message.

Thanks.
Well, taking a look at the Actual BP in your code

Code:
77D1872A or byte ptr [eax+FB4], 1
Here77D18731 call [ebp+8] There
77D18734 mov ecx, fs:[18]
In Here ESP+4 Is indeed pointing at the right address but when you are at There, ESP has changed because the call instruction pushes the return address into the stack.

So the question is, and I DO NOT know the answer off hand, does the Conditional gets evaluated before, during or after the call instruction??

I know that by design, 'Break on Read' or 'Break on Write' are evaluated AFTER the instruction at the bp has executed. . .
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how does ollydbg memory breakpoint works deXep General Discussion 5 10-15-2005 21:48
Olly conditional BP syntax? Rhodium General Discussion 2 07-20-2004 20:30
Olly conditional breakpoint help Rhodium General Discussion 9 07-21-2003 14:19


All times are GMT +8. The time now is 23:11.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )