Log in

View Full Version : What means NOP???


bINARy ShocK
October 31st, 2001, 03:31
...and how can i nop a function(?) out??? please give me an example. thx

Aimless
October 31st, 2001, 04:46
Its very difficult to NOP a function. You actuall NOP a function-call !!

xxxx:yyyyyyyy 67345667 call some_func
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661
(assuming the above is some disassembler output...)

Here, if you were told to NOP out the function some_func, you would have to:

1. Download a hex-editor
2. Open the file in hex-editor
3. Search for "67345667" without quotes
4. Replace these with "90909090" without quotes

Now if you disassemble this file AGAIN, you will see...

xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661

This process is called NOPPING a function-call.

...Have Phun

Phueghy
October 31st, 2001, 12:55
if you have too much time, you could check, what memory address the function calls, jump there and nop out every opcode till the corresponding ret.. but that's just stupid. so have better follow the method aimless told us.
just for the sake of it, *g
Phueghy

nobody
November 1st, 2001, 10:49
If the function is called often it is unpractical to nop every function call.
Another trick is to change the first instruction of the function with a "RET" instruction, efectively bypassing the function code. It is important to adjust the stack if necessary.

bINARy ShocK
November 1st, 2001, 12:34
but whats the difference?

Aimless
November 2nd, 2001, 09:08
No special difference...

One is a longer method

Other two are very short...

A matter of asthetic appeal (or sometimes protectionist check to see if function exists...)

...Have Phun