find_pointer_paths
Reverse-scan a dynamic address for static pointer paths rooted in a module, turning one-off finds into reusable chains for later runs.
Instructions
Reverse-scan for static pointer paths that reach an address.
The inverse of resolve_pointer_chain, and the step that turns a
throwaway find into something reusable: an address from scan_value
is different every run, but a path rooted in a module's image is the
same recipe every time. Run this on the address you confirmed, then
replay the best path in the next run with resolve_pointer_chain.
:param target_address: the dynamic address to find paths to.
:param max_depth: pointer levels to follow. Cost grows sharply with
depth; 1–4 is the useful range and 3 is a good default. A chain
needs at least one level, so 0 clamps to 1 rather than to the
default — and null means "use the default", as it does for
every argument here.
:param max_offset: largest offset a single hop may add — effectively
the assumed struct size. Larger finds more and noisier paths.
An explicit 0 is meaningful rather than "unset": it keeps only
hops that point exactly at the address. null means "use the
default" (1024), not 0.
:param max_results: stop after this many paths.
This is the most expensive tool here, and it runs in two phases: it
maps every pointer in the target's writable memory, then walks that map
backwards. The server's time budget bounds both phases, so a walk that
runs out of time returns the paths found so far with timed_out.
Expect seconds to minutes on a large process, and start shallow.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| max_depth | No | ||
| max_offset | No | ||
| session_id | Yes | ||
| max_results | No | ||
| target_address | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |