hi

i'm trying some rev on forester,a pcode visualbasic.

where can i find nfo about the pcode opcode value?

i used josephco exdec to decompile but dont understand how the branch work..here:

496869: 1c BranchF: 496895 ****(here)
49686C: 27 LitVar_Missing
49686F: 27 LitVar_Missing
496872: 27 LitVar_Missing
496875: f5 LitI4: 0x0 0 (....)
49687A: 3a LitVarStr: ( local_00C8 ) License Key Not Valid!
49687F: 4e FStVarCopyObj local_00B0
496882: 04 FLdRfVar local_00B0
496885: 0a ImpAdCallFPR4: _rtcMsgBox
49688A: 36 FFreeVar
496895: 1b LitStr: UNREGISTERED
496898: 54 FMemStStrCopy
49689D: 1b LitStr: 
4968A0: 54 FMemStStrCopy
4968A5: 1b LitStr: 
4968A8: 54 FMemStStrCopy
4968AD: f4 LitI2_Byte: 0x0 0 (.)

*** how is the 496869 offset calculated to reach 496895?
main code dumped from the exe give

00496869: 1C09 sbb al,009 ;" "
0049686B: 0327 add esp,[edi]
0049686D: E8FE2708FF call 0FF118470
00496872: 27 daa
00496873: 28FF sub bh,bh
00496875: F5 cmc
00496876: 0000 add [eax],al
00496878: 0000 add [eax],al
0049687A: 3A38 cmp bh,[eax]
0049687C: FFDB call ebx
0049687E: 004E50 add [esi][00050],cl
00496881: FF0450 inc d,[eax][edx]*2
00496884: FF0A dec d,[edx]
00496886: 36001400 add ss:[eax][eax],dl
0049688A: 360800 or ss:[eax],al

so the 1c is branch opcode and 0903 give access to 496895,thats what i dont understand and secondly where to find whats opcode pcode mean?
like 1c=branch or 0a=impadrcall etc..

thanks for any help..i'm lost

when i downloaded exdex there were a couple of tuts included in the zip-file. they explain the basics, i.e. opcodes for jumps and how to calculate the offsets. they're included in the attached zip-file.

to learn more about the opcodes, have a look at the wkt vb-debugger.

figugegl

thanks,i jump to unzip

It seems you shouldn't have arrived at that point (496869). Scroll a bit up and find a previous Branch which jumps past or before that address and possibly onto a "LargeBos".

Quick Hint:
1c: jump if false
1d: jump if true
1e: unconditional jump

Now for the disassembled text. It is completely useless. Discard it. To calculate the address to jump (destination), you have to find the start address (base)of the Procedure (not the proc number!). It is your starting point regardless of the destination you go. Example: your proc starts at 496000, you'd like to jump to 496005 you need 0500 bytes, to jump to 497005 you need 0510 bytes. So, at ANY address in between these block of bytes inside the proc, you can put 1E0500 to unconditionally jump.

You may want to try Muad'Dib & noptical's p-code jump generator attached.

thanks!!

it was the mystery!

solved thanks to you 2!


xxx