Posted: Fri Jul 11, 2014 9:51 pm Post subject: Writing ASM to a program from another program (not a dll)
I want to write assembly code to a specific location in another program. In my assembly code, I use jmp (module+offset). The location of (module+offset) and the location of the assembly code I wrote changes every time too (I'm using VirtualAllocEx). How would I write jmp (module+offset) to the program? When I try WriteProcessMemory the bytes change because so do the locations of the addresses each time I allocate memory and/or restart the program. I looked at this thread but I don't think it would work because I am not doing this from a dll, and instead I am doing it from an executable. Any ideas?
That macro will work just fine because the formula for calculating jmps is the same whether you use it inside dll or from another process.
Use your allocated cave as the code cave address (instead of the function address that that thread uses) and your original code (module+offset) as the original code location. Instead of using hard-coded addresses, you use locations you calculate on the fly (variables).
You can also simply use
mov eax, your codecave/destination
jmp eax
or
push your codecave/destination
ret
Simply calculate the opcodes for them (on the fly) and WPM them like you do a JMP. _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum