[Question] signed integers defined in the client ?

[multiuses]

hi there
if someone knows anything about signed integers defined in the client
cuz i tried a lots of times to edit the party matching max level to higher than 127 and it always shows a negative numbers ..
please some expert person to help me

[multiuses]

anyone knows ?

[multiuses]

still nobody knows ?

[Iwa13]

I don't know whether storage type of level is signed or not, probably not.

"push imm8" performs sign extension to operand before pushing the value into stack. So changing "push 6e" to any value that is higher than 127 does not do what we expect. (in that case, value becomes [imm8 FF FF FF] on stack, not [imm8 00 00 00])

This one does work for default max. level (thanks to kanift for testing)

pop edx
movzx eax,al
push eax
push E18B1C
jmp edx

[multiuses]

Originally Posted by Iwa13

I don't know whether storage type of level is signed or not, probably not.

"push imm8" performs sign extension to operand before pushing the value into stack. So changing "push 6e" to any value that is higher than 127 does not do what we expect. (in that case, value becomes [imm8 FF FF FF] on stack, not [imm8 00 00 00])

This one does work for default max. level (thanks to kanift for testing)

pop edx
movzx eax,al
push eax
push E18B1C
jmp edx

its seems there is a solution but i cant understand where did u get ' call <sro_client.pushzx_al_%d> ' ?
please can u explain more details ?

[florian0]

Originally Posted by multiuses

where did u get ' call <sro_client.pushzx_al_%d> ' ?
please can u explain more details ?

This technique is called a codecave. "pushzx_al_%d" is a custom defined function containing the instructions listed in the post.
There are many tutorials on basic codecaving. Choose "any" location in the binary that fits the size of these instructions, then redirect the original call to this call.
Make sure that no instructions "go missing" as you are going to possibly override some instructions.

[multiuses]

Originally Posted by florian0

This technique is called a codecave. "pushzx_al_%d" is a custom defined function containing the instructions listed in the post.
There are many tutorials on basic codecaving. Choose "any" location in the binary that fits the size of these instructions, then redirect the original call to this call.
Make sure that no instructions "go missing" as you are going to possibly override some instructions.

could u give me some hints ?
i searched about codecaving and found nothing i can use
please help if u dont mind ..

[florian0]

Doesn't explain as in-depth as it could be, but includes all the required steps.

[multiuses]

Originally Posted by florian0

Doesn't explain as in-depth as it could be, but includes all the required steps.

I see lots of "INT3" and "NOP" assembles
which one should i choose ?