waawaa / waawaa.github.io Goto Github PK

Hi, sorry, didn't know how to reach out to you elsewhere. I've been following your blog post about reversing Faronics DeppFreeze, and it's been great, thank you so much for sharing! I have a quick question - how exactly did you identify that function which is being call at 0046F10A call new is indeed new? I can see in WinDBG that it returns a new memory buffer via eax, but I don't see any calls to malloc/HeapAlloc or any other memory allocating APIs inside it, this is the only part that is not clear to me. Thanks again for the article!