View Full Version : What means NOP???
bINARy ShocK
October 31st, 2001, 03:31
...and how can i nop a function(?) out??? please give me an example. thx
Aimless
October 31st, 2001, 04:46
Its very difficult to NOP a function. You actuall NOP a function-call !!
xxxx:yyyyyyyy 67345667 call some_func
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661
(assuming the above is some disassembler output...)
Here, if you were told to NOP out the function some_func, you would have to:
1. Download a hex-editor
2. Open the file in hex-editor
3. Search for "67345667" without quotes
4. Replace these with "90909090" without quotes
Now if you disassemble this file AGAIN, you will see...
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661
This process is called NOPPING a function-call.
...Have Phun
Phueghy
October 31st, 2001, 12:55
if you have too much time, you could check, what memory address the function calls, jump there and nop out every opcode till the corresponding ret.. but that's just stupid. so have better follow the method aimless told us.
just for the sake of it, *g
Phueghy
nobody
November 1st, 2001, 10:49
If the function is called often it is unpractical to nop every function call.
Another trick is to change the first instruction of the function with a "RET" instruction, efectively bypassing the function code. It is important to adjust the stack if necessary.
bINARy ShocK
November 1st, 2001, 12:34
but whats the difference?
Aimless
November 2nd, 2001, 09:08
No special difference...
One is a longer method
Other two are very short...
A matter of asthetic appeal (or sometimes protectionist check to see if function exists...)
...Have Phun
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.