so i have this x.exe and patch.exe patch.exe launches x.exe and writes some things in memmory. how can i find out what memmory address patch.exe writes in x.exe ?
Dump patched image from memory and compare .code-sections (it won't help, if x.exe is packed/crypted). However, patch.exe can easily write to data-sections as well, thus better solution is to disassemble patch.exe, or, another method, to hook WriteProcessMemory function.
x.exe is packed with yoda's cryptor and patch.exe is packed with asprotect. did't work to unpack and dump. guess i will try hook. 10x
pragma Easily! WriteProcessMemory/ReadProcessMemory, set breakpoints on this functions with ntice & then analyze it.
