Log in

View Full Version : VB hex values for jumps and thier functions please?


CrAcKaHoLiC
January 8th, 2004, 21:36
Yes, I am a newbie and I am unsure of the exact terminology but the values 90, E9 and others are what I am asking about. I would like to get a table of all useable values and thier functions or explanation of proper usage guidelines. Does anyone have a link to such information or could you share your knowlege?

I am using W32dasm and a hex editor to get past registration and nag screens. I find the proper MOVs, CMPs and Jumps but I am unsure of the values to use in the offset to force the jump always. Thanks

naides
January 8th, 2004, 22:57
Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.

CrAcKaHoLiC
January 9th, 2004, 00:42
Quote:
[Originally Posted by naides]Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.

At Offset 00082f9d these are the bytes which is at the jne that needs to be modified; ce 00 00 00 0f bf 15 c8 82 4d 00 85 d2 75 10 c7 .....75 is where the "go to" offset takes me. I change it to eb and nothing happens so I dont know where to go from there. I dont know what to put there and why.

The W32dasm patch option gives original bytes of 75 10 C7 45 FC CF 00 00 00 66 C7 05 E8 80 4D 00 01 00 C7 45 the patch bytes are the same.

The only info I have to help is below

.:Hex:. .:ASM:. .:MEANING:.

75,0f85 jne jump if not equal
74,0f84 je jump is equal
eb jmp jump directly to
90 nop no operation
77,0f87 ja jump if above
0f86 jna jump if not above
0f83 jae jump if above or equal to
0f82 jnae jump if not above or equal
0f82 jb jump if below
0f83 jnb jump is not below
of86 jbe jump if below or equal
0f87 jnbe jump if not below or equal
0f8f jg jump if greater
0f8e jng jump if not greater
0f8d jge jump if greater or equal
0f8c jnge jump if not greater or equal
0f8c jl jump if less
0f8d jnl jump if not less
0f8e jle jump if less or equal
0f8f jnle jump if not less or equal

Kythen
January 9th, 2004, 01:24
You might want to check out the Intel P4 reference manuals, the IA32 instruction set reference in particular. Or you could get AMD's manuals... they have fewer typos.

nikolatesla20
January 9th, 2004, 11:14
Just get a copy of MASM32.

hxxp://www.movsd.com/masmdl.htm

Then run the main program, and go to Help. It has an nice opcodes reference, which I've used a LOT.

-nt20

CrAcKaHoLiC
January 9th, 2004, 13:30
Quote:
[Originally Posted by Kythen]You might want to check out the Intel P4 reference manuals, the IA32 instruction set reference in particular. Or you could get AMD's manuals... they have fewer typos.

I downloaded IA32 instruction set reference volume 2, it is quite extensive with 800 plus pages. I have ADD but will try to make sense of it but what a brain load!

CrAcKaHoLiC
January 9th, 2004, 13:38
Quote:
[Originally Posted by nikolatesla20]Just get a copy of MASM32.

hxxp://www.movsd.com/masmdl.htm

Then run the main program, and go to Help. It has an nice opcodes reference, which I've used a LOT.

-nt20

Thanks for the suggestion, I will do that as I simply want to crack a couple of programs for personal use. I am more of a hands on learner and don't absorb much through reading unless it is need specific.

CrAcKaHoLiC
January 9th, 2004, 13:53
Quote:
[Originally Posted by naides]Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.

I fired up Hiew and It works fine useing assemble mode. I changed the jne to jmp but have not cracked it. I am still looking through the strings refering to "registration" though. Thanks

naides
January 9th, 2004, 14:18
What you describe suggest that changing that jump was not enough to crack the application.
Perhaps more checks are performed somewhere else in the program.

LOUZEW
January 9th, 2004, 14:40
Hi,CrAcKaHoLiC
I've seen the same post on an other board, i think you have now enough responses no ? ?
Quote:
[Originally Posted by CrAcKaHoLiC]I fired up Hiew and It works fine useing assemble mode. I changed the jne to jmp but have not cracked it. I am still looking through the strings refering to "registration" though. Thanks

CrAcKaHoLiC
January 9th, 2004, 14:52
Quote:
[Originally Posted by LOUZEW]Hi,CrAcKaHoLiC
I've seen the same post on an other board, i think you have now enough responses no ? ?
Yes I do and I have cracked the prog with all the help from the guys who replied to this post. If you are suggesting that I should not have posted the same question on another site you are mistaken and I consider your post to be spam. BTW I did not get any response from the other site or at least I did not receive email notifcation of such.

Thanks to all the people who answered this post, you were all a great help to me! There were three jumps to change and crack this baby.

LOUZEW
January 9th, 2004, 17:00
You have 3 responses on the other board, and YOU reply ? ?
Maybe your post title no such close to your real needs ! !

Quote:
[Originally Posted by CrAcKaHoLiC]Yes I do and I have cracked the prog with all the help from the guys who replied to this post. If you are suggesting that I should not have posted the same question on another site you are mistaken and I consider your post to be spam. BTW I did not get any response from the other site or at least I did not receive email notifcation of such.

Thanks to all the people who answered this post, you were all a great help to me! There were three jumps to change and crack this baby.

dELTA
January 9th, 2004, 18:33
There is nothing terrible about asking the same thing on different boards. Pointless flames are worse, take it outside.

LOUZEW
January 10th, 2004, 07:09
I'm not saying it's forbiden to ask on different boards, I understand that very well, it's just he ask only for assembly "jump" Hex Codes on the other board and it had just responses concerning that. Here he is asking more (How to crack . . .).
It's not critical, it's just a remark !

Peace !

Quote:
[Originally Posted by dELTA]There is nothing terrible about asking the same thing on different boards. Pointless flames are worse, take it outside.