netapi32.dll - searching for certain instruction
I'm trying to figure out how the Unhandled Exception Filter heap overflow works. I pretty much know what is supposed to happen, but I need to find the instruction开发者_如何学Go "call dword ptr[edi+0x78]" in netapi32.dll.
Can you help me find that instruction. I tried to use ollydbg, I Loaded the netapi32.dll and searched for a command, then inputted "call dword ptr[edi+0x78]", but nothing.
Is there more effective way for searching such instructions?
The problem with ollydbg is that whenever searching for a command you have to type exactly as the debugger presents the command (no regular expressions allowed). This is the line that I used:
call dword ptr ds:[edi+78]
it works now.
精彩评论