2009-05-06, 03:30 PM
I actually burned a lot of time last night trying to find counter addresses after I noticed I could debug/dump a process directly from Taskmanager.
I never have any luck with this sort of thing. The counters sould be 16bit -- 65535 is their max setting. I setup an always on event to load ABACAB into three counters and a bunch of zeros in the next three, but I couldn't find any sequential addresses that reflected these values... so if I know what I'm doing, the counters aren't stored sequentially. Still digging around the dump in the general SoM region (it's full of other dlls) I didn't find anything that looked very suspicious (well yet)
I saw a lot of stuff that looked like it was probably multibyte character encoding, but my hexeditor dejour did not do non UNICODE multibyte output (so are there any untranslated stuff left in the latest translation??)
I tried to find some decompilers... but couldn't find anything too useful. I will try your link I guess (it was dead for me the other day -- but seems to be downloading atm)
I never have any luck with this sort of thing. The counters sould be 16bit -- 65535 is their max setting. I setup an always on event to load ABACAB into three counters and a bunch of zeros in the next three, but I couldn't find any sequential addresses that reflected these values... so if I know what I'm doing, the counters aren't stored sequentially. Still digging around the dump in the general SoM region (it's full of other dlls) I didn't find anything that looked very suspicious (well yet)
I saw a lot of stuff that looked like it was probably multibyte character encoding, but my hexeditor dejour did not do non UNICODE multibyte output (so are there any untranslated stuff left in the latest translation??)
I tried to find some decompilers... but couldn't find anything too useful. I will try your link I guess (it was dead for me the other day -- but seems to be downloading atm)