|
if the param is passed on the stack, the has to come from somewhere
like the mov ecx, [ebp+0ch]
check the start of the proc, back trace
and find where the [ebp+0ch] is set
it'll probably be something like mov eax, [11223344]
or push [11223344] or something similar...
'stacked pointer' is just the param passed on the stack, backtrace and see where it came from...
__________________
bleh
DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you...
|