assembly - How do I attach to a process and read from specific instruction? -

i'm trying write "shunt" existing application spew out data can integrate analysis i'm trying perform, i've hit dead end. i've isolated instruction want read from, i'm not sure how accomplish this.

this instruction set i'm trying isolate (specifically value 00412159):

00412153 - mov [eax+04],edx 00412156 - fld dword ptr [ecx+08] 00412159 - fstp dword ptr [eax+08] 0041215c - ret 0041215d - int 3 

results of 3 memory scans same variable resulted in following results:

eax=1798b4e0 ecx=0018d5c0 edx=00000016  eax=18d96298 ecx=0018d5c0 edx=00000016  eax=18d3dca8 ecx=0018d5c0 edx=00000016 

if attach debugger running program, value want @ eax, value of eax changes each time target process restarted.

evidently i'm running dma (dynamic memory access) aka heap-based memory allocation , causing pointer mapping generated @ runtime. brief research subject revealing 2 components need figure out static base pointer, , offset used reach runtime pointer.

i've spent total of 4 hours experiance asm, may problem, or i'm tackling problem out of league. ideas on best way read value instruction @ 00412159 or suggestion on how find base pointer , offset?

sorry late answer.

basically application dynamically allocates memory when starts. (think malloc or in high-level programming)

if find allocation code, can find address of start of memory allocated , it's size think important variables know.

then need debugger put breakpoint @ 00412159 trace backward going in code manually , find eax has been initialized dynamic address.

other that, defeating dma has been matter of experience , debugging skills each programs different. if post assembly listing here might able in right direction.