Pages: [1]
Author Topic: Almost tracked rkukg_w but not sure :)  (Read 4001 times)
masterj
Hero Member
*****

Karma: +62/-5
Offline Offline

Posts: 1049



WWW
« on: September 10, 2014, 08:44:36 AM »

Guys, anyone remembers how rkukg_w looks in gk when disassembled?

Please check out attached image... I kinda suspect either word_FE0E or word_FE0C
Logged

elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #1 on: September 10, 2014, 12:15:05 PM »

Right out of view above what you showed (the very next grouping) you'll find two mov

mov r4, word_38xxx1 ;fra_w
mov r5, word_38xxx2 ;rkukg_w
jmpr cc_N, loc_86xxxx



The second mov is your rkukg_w


That memory location should xference to only two functions (GK, and ESUK).


What you have circled in red is fra_w being mul to the result after rkukg_w has being added (top boxes in your img). fra_w is the other var  in the grouping I mentioned above.
« Last Edit: September 10, 2014, 12:22:36 PM by elRey » Logged
masterj
Hero Member
*****

Karma: +62/-5
Offline Offline

Posts: 1049



WWW
« Reply #2 on: September 10, 2014, 12:49:54 PM »

Right out of view above what you showed (the very next grouping) you'll find two mov

mov r4, word_38xxx1 ;fra_w
mov r5, word_38xxx2 ;rkukg_w
jmpr cc_N, loc_86xxxx



The second mov is your rkukg_w


That memory location should xference to only two functions (GK, and ESUK).


What you have circled in red is fra_w being mul to the result after rkukg_w has being added (top boxes in your img). fra_w is the other var  in the grouping I mentioned above.

thanks very much!
Logged

Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.016 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)