NefMoto

Technical => Reverse Engineering => Topic started by: toxictuning on June 19, 2025, 03:00:06 AM

Title: MED9.1 Correlate Ram Variables To Pointers
Post by: toxictuning on June 19, 2025, 03:00:06 AM

Hello

Im working on a MED9.1 project, im able to label the internal variables, i see some files have 2000, some have 2200.
I have not seen another size but also I have not compared too many files.

I can find the address and size in most files but i can't seem to figure out how to correlate the points without using the tester information.

Code:

        004a6ca4 00  03  83  60    addr       mshfm_w
        004a6dac 00  03  8a  f4     addr       plgru
        004a6db0 00  03  8b  04    addr       plgru_w

TIA

Title: Re: MED9.1 Correlate Ram Variables To Pointers
Post by: elias on July 01, 2025, 04:13:55 AM

I usually use MED9info tool (can be found here on nefmoto) to display all variables. It works very well

Variables which cannot be found using that tool, can usually by matching the binaries with Ghidra. Code is pretty similar through all variants.