| View previous topic :: View next topic |
| Author |
Message |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Sun Mar 22, 2009 10:03 pm Post subject: Solved: ASM help, how does this correlate? |
|
|
jmp 29019996
How do the bytes correlate to: e9 63 51 c1 28
Because i'm going to be changing the opcode dynamically, how does that correlate to that address?
Last edited by mStorm on Mon Mar 23, 2009 10:50 am; edited 1 time in total |
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Sun Mar 22, 2009 11:19 pm Post subject: |
|
|
It's the relative distance. | Code: | | (Destination - CurrentLocation) - 5 |
P.S. The VA for your mnemonic is 40482E.
_________________
|
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Sun Mar 22, 2009 11:35 pm Post subject: |
|
|
So, the sizeof(what?)
sizeof the jump + address opcode?
|
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Sun Mar 22, 2009 11:57 pm Post subject: |
|
|
Hmm, implemented the function and it gives:
I'm looking for x86. This is my use:
| Code: |
WriteJump((LPVOID)0x00404823, (LPVOID)((DWORD)mbi.BaseAddress+i+0x17));
|
|
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Mon Mar 23, 2009 12:04 am Post subject: |
|
|
It should work considering the fact that ULONG_PTR is defined as:
| Code: | #if defined(_WIN64)
typedef __int64 LONG_PTR;
#else
typedef long LONG_PTR;
#endif |
Which means it doesn't matter if the system is x64 or x86.
Anyways, the error is because lpAddress is not incremented by one before the call to InterlockedExchangePointer().
_________________
Last edited by sponge on Mon Mar 23, 2009 12:14 am; edited 2 times in total |
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Mon Mar 23, 2009 12:05 am Post subject: |
|
|
| Argh, it's giving me a bunch of tests , etc.
|
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Mon Mar 23, 2009 12:20 am Post subject: |
|
|
Replace:
| Code: | | InterlockedExchangePointer(lpAddress + sizeof(BYTE), ulOffset); |
_________________
|
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Mon Mar 23, 2009 2:09 am Post subject: |
|
|
| danke!
|
|
| Back to top |
|
 |
|