Orchid XP v7 wrote:
> That's impressive. Usually these things work by inserting software 
> interrupts into the code. (Or just software enumation of machine state...)

Nowadays, actually, they tend to play with the memory map to cause traps 
to occur where you want to see things. Breakpoint when you write a 
variable? Map the page the variable is in as read-only, then when the 
trap happens, see if the instruction was pointing to the variable.

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message