After I press F7 it jumps to a certain address, something like
Code:
client.Call::Call+XXXXXX
I know the value of client.Call::Call and EAX at the break point, so I try to calculate where it jumps before it does and I fail every time because eax*4+client.Call::Call+1528EF is never equal client.Call::Call+XXXXXX where it actually goes.
I need to record all the addresses where jumps go to and I hoped it's eax*4+client.Call::Call+1528EF but it's not and I'm lost
Posted: Fri Aug 16, 2013 3:46 pm Post subject: Re: Need help tracking jmp
toffler wrote:
What am I missing, can anyone please explain?
You're mixing up between:
Code:
jmp dword ptr [eax*4+client.Call::Call+1528EF]
and:
Code:
jmp eax*4+client.Call::Call+1528EF
The second one would jump to address eax*4+client.Call::Call+1528EF if it were a valid assembly instruction (which it isn't).
The first one reads the dword at address eax*4+client.Call::Call+1528EF, interprets it as an address and jumps there.
So if eax*4+client.Call::Call+1528EF = 0x12345678, then at address 12345678 you should have a dword equal to client.Call::Call+XXXXXX .
toffler wrote:
I need to record all the addresses where jumps go to
Go to address client.Call::Call+1528EF in the memory dump and you'll see a sequence of dwords. They are all the possible jump targets for this jump, now you problem is to figure out how many different targets your jump has (= maximum eax value at that place). _________________
DO NOT PM me if you want help on making/fixing/using a hack.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum