Difference between revisions of "Auto Assembler:aobScanRegion"
Jump to navigation
Jump to search
(Created page with 'Category:Assembler '''Auto Assembler''' aobScanRegion(''SymbolName'', ''StartAddress'', ''StopAddress'', ''AOBString'') Scans the memory of a specific region for the given a…') |
(No difference)
|
Revision as of 01:12, 13 January 2018
Auto Assembler aobScanRegion(SymbolName, StartAddress, StopAddress, AOBString)
Scans the memory of a specific region for the given array of byte and sets the result to the symbol name. 'x', '?', and '*' are seen as a wildcard.
Note: Wildcards can be written as one per byte or one per character of byte.
- If separated by spaces the wildcard will be interpreted as a byte.
i.e.:
5x 48 8D 6x 24 E0 5? 48 8D 6? 24 E0 5* 48 8D 6* 24 E0 xx 48 8D xx 24 E0 ?? 48 8D ?? 24 E0 ** 48 8D ** 24 E0 x 48 8D x 24 E0 ? 48 8D ? 24 E0 * 48 8D * 24 E0
Command Parameters
| Parameter | Type | Description |
|---|---|---|
| SymbolName | string | The symbol name to use if aob is found |
| StartAddress | string | The address to start scanning from |
| StopAddress | string | The address to stop scanning at. |
| AOBString | string | The string of bytes, as hex, to scan for |
Examples
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 53 48 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 xx xx 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 5x 48 xx 6x 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 x x 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 ** ** 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 5* 48 *D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 * * 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 ?? ?? 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 5? ?? 8? 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 00 ? ? 8D 64 24 E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 005x8xxxxxE0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 005*8*****E0)
aobScanRegion(SomeSymbol, Tutorial-i386.exe+4000, Tutorial-i386.exe+5000, 005?8?????E0)
