PDA

View Full Version : FOR PSYCKO PLEASE HELP ME


Ricardo Narvaja
July 11th, 2004, 23:38
The GN command store in variable $RESULT the string of the name of the api, this is perfect, but i need store this name in a position of memory.

My script

var ju
var pu
var ta


mov ju,403184
mov ta,401000


mov pu,[ju]

gn pu

log $RESULT

mov [ta],$RESULT

ret

[ju] is an address of an API, in $RESULT is the name of the api, but is impossible store this name in any form with MOV [ta],$RESULT

How i can STORE the name of the api in a memory

THANKS IN ADVANCE

This is very important with this i can make a incredible tute, thanks.

Ricardo

psyCK0
July 13th, 2004, 12:26
Will come in v0.92 which is coming as soon as the site is up again.
BTW, do you want it as
kernel32.ExitProcess
or just
ExitProcess ?

Ricardo Narvaja
July 13th, 2004, 15:53
If is possible can be stored kernel32 in one variable and ExitProcess in other variable?

If this is possible my tute will be very great a new revolutionary method in rebuilding tables with your great help, thanks in advance.

Ricardo

psyCK0
July 13th, 2004, 16:10
GN will return:

$RESULT - kernel32.ExitProcess
$RESULT_1 - kernel32
$RESULT_2 - ExitProcess

This is not a good solution, but I cant come up with any better. Therefor the $RESULT_1 and $RESULT_2 will be kinda undocumented features - I won't guarantee what they will be if the address passed to GN is not for an API. =)

Ricardo Narvaja
July 13th, 2004, 16:33
thanks is good for me, thanks.

Ricardo