///////////////////////////////////////////////
//
//	GemCollect by trapflag
//
//	GemCollect is an IDC script for the
//	Interactive Disassembler Pro by DataRescue
//	-------------------------------------------
//
//	Often you need to find the exact address of
//	a variable in a running process in memory.
//	These addresses are mostly stored in
//	dynamically allocated memory and may vary.
//	This script helps you to track down the
//	address(es) as well as the code accessing
//	those address(es).
//
//	Usage:
//	0.	Load the script into IDA.
//	1.	Run the process, then suspend it
//			and start a search for a known value.
//	2.	Resume the process, wait for the value
//			to change, then suspend the process
//			and continue the search for the now
//			changed value.
//	3.	Repeat step 2 until you found the
//			address holding your value.
//	4.	When you found the desired address,
//			you can set a hardware breakpoint on
//			it to reach the code modifying the
//			value.
//	-------------------------------------------
//
//	Because the script is an add-on for a very
//	powerful disassembler and a good debugger
//	in between, it has the following advantages
//	over similar standalone-tools:
//
//	* Pause the process anytime using IDA's
//		debugger
//	* Set (hardware) breakpoints on the
//		memory addresses found.
//	* Debug/reverse engineer the code accessing
//		the memory addresses.
//	* Use the script on a client computer while
//		running the process on a server using
//		IDA's remote debugging capabilities.
//
//		This is especially useful for processes
//		that prevent you to switch back to Windows!
//
//		For instructions on how to set up two
//		machines for remote debugging, please
//		refer to the excellent tutorials on
//		www.datarescue.com/idabase
//
//
//	If you want to purchase the Interactive
//	Disassembler (IDA) go to www.datarescue.com
//
//	For more plugins and IDC scripts visit
//	www.backtrace.de
//
//	-------------------------------------------
//
//	history:
//	--------
//	-	19.09.2004:
//		initial version.
//
//	-	25.09.2004:
//		added hotkey to re-print the addresses
//		found.
//
//	-	07.10.2004:
//		first public release.
//
//	For questions regarding this script:
//		trapflag(at)backtrace(dot)de
//
//	(c) 2004, trapflag
//
///////////////////////////////////////////////