Page 1 of 1

How to retrieve an RSI value as an address ?

Posted: Sun Sep 04, 2022 1:29 pm
by KevinDA
How to get the RSI value as an address without going through the registers each time ?

Hello, I explain my problem :

The starting address of the rax is 00000000000001BF, with the calculation ( lea eax,[rax+rax*4] ) RAX = 00000000000008BB
Then ( lea ecx,[rdx+rax*2] ) RCX = 0000000000001177
Then ( lea esi,[rcx+rcx*4] ) RSI = 0000000000005753
After ( add esi,esi ) RSI = 000000000000AEA6

I would like to recover directly RSI as an address without passing each time by the registers how to make?
Because with the following code it is not stored in any address afterwards.
And if I modify RAX = 00000000000001BF at the beginning the application crashes.
Is there any way to get RSI without going through registers each time ? (Like an address ????)
Image

Re: How to retrieve an RSI value as an address ?

Posted: Sun Sep 04, 2022 2:33 pm
by Paul44
^ it is not an address, but (probably) some offset. basically: lea eax,[rax+rax*4] => eax = rax*5 (and add esi,esi = 2*esi). that value is then stored on the stack. you could "follow up" on that stack address, but i doubt that will help you out. probably best thing would be to store it in a var.
bottomline: if you do not know what/when that value is used for, you'll remain in the dark... ?

Re: How to retrieve an RSI value as an address ?

Posted: Sun Sep 04, 2022 2:38 pm
by KevinDA
How can I change this address every time without going through the registry ?
Isn't there an address ?