Quote:
Originally posted by ztthik+Jan 6 2007, 02:58--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (ztthik @ Jan 6 2007, 02:58)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin--Flyers@Jan 6 2007, 02:26
Btw, for below i change it to 40359c, then i was prompt for the btye was different shld i replace it with nop yes or no?? am i doing it rite??
/** set trap on first jump here and by pass
00403596 je 40378c <- by pass this point to 40359C
0040359C move ecx,[ebp-2c]
|
there are at least 2 methods to bypass the instruction.
origianl code:
---------------------------------------------------
00403596 0f 84 f0 01 00 00 je 40378c
0040359C 8b 4d d4 move ecx, [ebp-2c]
----------------------------------------------------
you want to bypass the instruction 403596 and go to 40359C.
method 1:
replace memory address 403596 -- 40359B with '90' (nop),
the code becomes
--------------------------------------------------
00403596 90 nop
00403597 90 nop
00403598 90 nop
00403599 90 nop
0040359A 90 nop
0040359B 90 nop
0040359C 8b 4d d4 move ecx, [ebp-2c]
----------------------------------------------------
method 2:
calculate the offset to determine the new address to jump
replace memory address 403598 -- 40359B with '00'
---------------------------------------------------
00403596 0f 84 00 00 00 00 je 40359c
0040359C 8b 4d d4 move ecx, [ebp-2c]
----------------------------------------------------
00 00 00 00 = 40359c - 403596 - 6
40359c: where you want to go
403596: where you are
6: the length of the jump instruction
Hope it can help you a little bit. [/b][/quote]
Thanks, trying it out...