What exactly do you mean by a "when a program does a call"? If you're talking about assembly-level calls then I have some good news and some bad news. The good news is you can put a breakpoint on every call. The bad news is there are hundreds of thousands of calls, which is a bit of a pain to break on every possible call. In practice it's best to set a memory breakpoint i.e. when you know that a function accesses (read or write) some variable, you can put a memory breakpoint on that variable. That will stop the execution at the exact assembly instruction (EIP) that tried to access the variable in question, thus locating your function.
EDIT: to help you out a bit, here's the address for the chat function. It takes one parameter, I think it's a pointer to a null-terminated string.
SendChat - 1.23: 0x483DE0, TSF: 0x4833A0
__________________
<a href="http://nmap.org/"><img border="0" alt="Nmap Security Scanner" src="http://images.insecure.org/nmap/images/prop/nmap_bnr_matrix_pfos.gif"/></a>
Last edited by Cpp; Apr 13, 2009 at 11:40 AM.
|