R
R
rusianvodka2014-05-28 03:29:05
C++ / C#
rusianvodka, 2014-05-28 03:29:05

How to open an exe file and get the address of the storage area for all variables?

Hello, ladies and gentlemen, what an hour I have been sitting, but I cannot understand and understand.
I want to open an exe file and find the place where all the numeric constants of the declared variables are stored.
For example, there is a code

#include <iostream>
#include <conio.h>
using namespace std;
void main(){

  int g = 1998;
  int b = 2000;
  int l = 5;
  _getch();
}

Compiled, created an exe file, then open it.
I want to know how to get the place (address) from which all numerical constants of variables in the exe file start to be stored, and by which one.
I read these articles:
cs.usu.edu.ru/docs/pe
www.xakep.ru/magazine/xs/057/026/1.asp
Googled, tried to understand, but this topic is just a forest for me. As I understand it, you need to first read the information into the declared structures from certain points, and then pull out the address.
I would be grateful for tips, if you show the code with an example of how to do all this, it will be great.

Answer the question

In order to leave comments, you need to log in

3 answer(s)
S
svd71, 2014-05-28
@svd71

I won’t show you an example, because it was a long time ago. But I remember this trick: list all sections of the file. Each variable (I don't mean the local variables of any function) is stored in a separate section. The same applies to functions.
A connection but this is a matter of linking and optimization. So the linker can find variables and functions that are not used in the program (to those sections where no one refers) and simply not link them to the file.

R
Rsa97, 2014-05-28
@Rsa97

And why are you sure that the constants are stored somewhere? Compile through assembler and see. Let's say C++ Builder generates code like this:

@_main	proc	near
  push      ebp
  mov       ebp,esp
  add       esp,-12
  mov       dword ptr [ebp-4],1998
  mov       dword ptr [ebp-8],2000
  mov       dword ptr [ebp-12],5
  call      @__getch
  mov       esp,ebp
  pop       ebp
  ret 
@_main	endp

That is, all constants are directly in the code.

M
mrbaranovskiy2, 2014-06-01
@mrbaranovskiy2

I think it's easier to take ollydbg and debug your program. More complete information will be difficult to obtain on your own.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question