View previous topic :: View next topic |
Author |
Message |
kitesan Expert Cheater Reputation: 0
Joined: 01 May 2014 Posts: 124
|
Posted: Sat Jun 07, 2014 3:31 am Post subject: ASM question |
|
|
Hello guys, i would like to know how to move the address represented by esi+04
into a variable i made (as value)
example:
//MY CODE: mov [ADDRESS CONTAINER], Address represented by esi+04
help me..
|
|
Back to top |
|
|
mgr.inz.Player I post too much Reputation: 218
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Sat Jun 07, 2014 3:50 am Post subject: |
|
|
Represented by esi+04
Code: | push eax
lea eax,[esi+04]
mov [ADDRESS_CONTAINER],eax
pop eax |
Represented by value kept in address pointed by esi+04
Code: | push eax
mov eax,[esi+04]
mov [ADDRESS_CONTAINER],eax
pop eax |
_________________
|
|
Back to top |
|
|
kitesan Expert Cheater Reputation: 0
Joined: 01 May 2014 Posts: 124
|
Posted: Sat Jun 07, 2014 3:55 am Post subject: |
|
|
thanks alot.
what is the proper way to set that kind of vardiable?
example:
registersymbol(variable name)
label(variabe name)
variable_name:
...
etc..
|
|
Back to top |
|
|
mgr.inz.Player I post too much Reputation: 218
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Sat Jun 07, 2014 4:30 am Post subject: |
|
|
It depends on what you want to achieve.
If you want ADDRESS_CONTAINER to be available outside AA script, use something like this:
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(ADDRESS_CONTAINER)
registersymbol(ADDRESS_CONTAINER)
newmem:
push eax
lea eax,[esi+04]
mov [ADDRESS_CONTAINER],eax
pop eax
//original instructions here
jmp returnhere
ADDRESS_CONTAINER:
dd 00
addressofinjection:
jmp newmem
nop
nop // some nops
returnhere:
[DISABLE]
addressofinjection:
//original instructions here
unregistersymbol(ADDRESS_CONTAINER)
dealloc(newmem) |
Of course addressofinjection will be hex address or module+offset.
_________________
|
|
Back to top |
|
|
kitesan Expert Cheater Reputation: 0
Joined: 01 May 2014 Posts: 124
|
Posted: Sat Jun 07, 2014 4:49 am Post subject: |
|
|
thanks for your help
|
|
Back to top |
|
|
|