[Classic] How to find the NameCachePtr the unconventional way

[Buntstift]

Hello, i got few mails over the last month with the question for the NameCachePtr.
I do not reverse it over IDA. I just try it over poking in the memory. It seems to be complicated, it isnt! Usualy i dont need longer then ~2 minutes for this procedure.


Full resolution of this little guide:
ibb.co/s2sHZXQ
(dont work with uBlock)
direct link to hq-img: https://i.ibb.co/L8953s6/rv-ncp-hq2.jpg

Low resolution (forum-attachment):
rv_ncp_lq.jpg



My didacting skills in combination with my english isnt very good. So if you have any question, dont hesitate and ask me.

[xbec]

great,,how can IDA find it?
And after I used CE, wow crashed.