On Mon, 12 Nov 2007 20:09:27 +0100, Orchid XP v7 <voi### [at] devnull> wrote:
> Darren New wrote:
>> Orchid XP v7 wrote:
>>> That's impressive. Usually these things work by inserting software  
>>> interrupts into the code. (Or just software enumation of machine  
>>> state...)
>>  Nowadays, actually, they tend to play with the memory map to cause  
>> traps to occur where you want to see things. Breakpoint when you write  
>> a variable? Map the page the variable is in as read-only, then when the  
>> trap happens, see if the instruction was pointing to the variable.
>
> Interesting. I thought (in C) all variables exist on the machine stack?

Not true, but even so, the stack is still memory.


-- 
FE

Post a reply to this message