Log in

View Full Version : Stupid assembly-related question


kralik
March 26th, 2007, 10:16
Hi Im new here, my names Kralik and im 17yrs old and I speak stupid
english cause Im a beginer

Anyway

Ive got a stupid question about the assembly 'call' instruction.

I need to add this into existing exe:
Code:

mov eax, [eax+0000031d]
mov edx, 00537A54
call 0046781C
ret

So the bytes I need to add should look like this is that right?
Code:
8b801d030000ba547a5300e8????????C3 <-- some more bytes here...?

Now my question: with what should I replace the question marks?

Thanks for help...

naides
March 26th, 2007, 10:40
A simple answer:

The bases of the problem is:

call 0046781C.

The address 0046781C is RELATIVE to the code address form where the call is being made.
If you try to assemble this code out in the clear blue or inside a small file using the assembler of hiew, that address, 0046781C lands outside the file limits, so the assembler puts ??? instead.

The simplest solution is to assemble the snippet using Olly, with the original file loaded.
Olly will compute for you the relative distance between your code and the Called address and transparently adjusted for you.

another problem is you are trying to ADD instructions to the code. You may not be able to do that directly, because you may overwrite important instructions at the site of your injected code.
Thing to do is to find a cave in the code, a place filled with zeros.

Then you assemble a jump to the cave, write at the cave your code snippet,

mov eax, [eax+0000031d]
mov edx, 00537A54
call 0046781C
ret

let it return to the upper level in the call stack.

Hope it makes sense, or provide more detail.

disavowed
March 26th, 2007, 10:40
Easiest way to do this is to patch in the assembly code in "real-time" with OllyDbg and see what hex bytecode Olly puts in.

disavowed
March 26th, 2007, 10:41
naides, great minds think alike.. and within seconds of each other

naides
March 26th, 2007, 10:47

LLXX
March 27th, 2007, 02:14
HIEW. Its assembler also does RA calculations.