Ultimap1

Owners of older Intel Gen5 and earlier CPUs and owners of Intel Gen6 CPU with early implementation of IPT can try using Ultimap1, as long as they can successfully enable DBVM. Note: CE saying DBVM is supported is not enough; they actually have to enable it.

Ultimap1 is available through the Memory Viewer dialog. One can either click on the 'Tools' menu and select it from there, or hit the CTRL+ALT+U hotkey. Either way CE presents the following dialog:

From here, users will want to click the 'Start' button first. At that point, users can go back to the application and force execution of the code they are looking for, and, click 'Code has been executed' after they came ALT+TABed back into CE. Users can also eliminate a lot of the false positives using any of the other buttons. In the end, once they have an acceptable number of results, users would click the 'Show matching routines' button on the bottom. Congrats on finding the code without having to go through the hassle of finding the value first and then tracking it all the way back to the code.

Do yourself a favour and read the tip on the bottom of the dialog. These hotkeys are a tremendous help to using Ultimap successfully.