Ultimap1

Owners of older Intel Gen5 and earlier CPUs and owners of Intel Gen6 CPU with early implementation of IPT can try using Ultimap1, as long as you can successfully enable DBVM. Note: CE saying DBMVM is supported is not enough; you actually have to enable it.

Ultimap1 is available through the Memory Viewer dialog. You can either click on the 'Tools' menu and select it from there, or hit the CTRL+ALT+U hotkey. Either way, you will end up with this dialog:

From here, you will want to click the 'Start' button first. At that point, you can go back to the application and force execution of the code you are looking for and click 'Code has been executed' after you came back to CE. You can also eliminate a lot of the false positives using any of the other buttons. In the end, once you have an acceptable number of results, you can click the 'Show matching routines' button on the bottom. Congrats, you found the code you need, without having to go through the hassle of finding the value first and then tracking it all the way back to the code.

Do yourself a favour and read the tip on the bottom of the dialog. These hotkeys are a tremendous help to using Ultimap successfully.