Disassembling: How can I retrieve the address of a module's global variable via a function?

73 Views Asked by At
const char* BotArgs[4]
bool UseBotArgs

Knowing this function's address, is it possible to retrieve the address of these global variables as well? If yes, I would also like to know how to get the offsets of them. Thanks!

IDA Disassembler: mp.dll IDA Disassembler: mp.dll & cs.so (code)

1

There are 1 best solutions below

0
Botje On

You can read the addresses directly from the machine code. For example, your mov Str, eax instruction is A3 78 E3 0F 10. This is little-endian for 0x100FE378.

If you look at the next three mov calls, they assign to addresses 0x100FE380 through 0x100FE384.

So BotArgs = fn+7 and UseBotArgs = fn+37.