View previous topic :: View next topic |
Author |
Message |
spacebar How do I cheat? Reputation: 0
Joined: 23 Aug 2008 Posts: 7
|
Posted: Wed Mar 15, 2017 3:26 pm Post subject: jump in auto assemble |
|
|
Hi guys,
I'm trying to use auto assemble to change a je to a jmp. When I change it manually in memory (set the bytes to EB to get a jmp), it works fine but when i do it through auto assemble it crashes.
I think it has something to do with the return point. since im jumping somewhere and then autoassemble might go back to where it came from (the place where i changed je to jmp)?
I'm not quite sure how to deal with it, any advice would be appreciated.
Here's the code:
Code: |
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
jmp game.exe+B20A9
mov ebx,[ebp-38]
exit:
jmp returnhere
"game.exe"+B2098:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"game.exe"+B2098:
je game.exe+B20A9
mov ebx,[ebp-38]
//Alt: db 74 0F 8B 5D C8
|
|
|
Back to top |
|
|
++METHOS I post too much Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Wed Mar 15, 2017 4:42 pm Post subject: |
|
|
More than likely, you are breaking a jump. Try injecting above that injection point, or, write a script that only changes the bytes for that one instruction (i.e. that does not require a codecave).
EDIT:
So, for example, something like these:
Code: | //Target: firefox.exe
//Author: ++METHOS
[ENABLE]
{==================== example ====================}
aobscanmodule(aob_example,firefox.exe,74 0F 57 6A 02)
registersymbol(aob_example)
aob_example:
db EB 0F
[DISABLE]
aob_example:
db 74 0F
unregistersymbol(aob_example) |
Code: | [ENABLE]
"firefox.exe"+5E7B:
jmp firefox.GetHandleVerifier+3BCA
[DISABLE]
"firefox.exe"+5E7B:
je firefox.GetHandleVerifier+3BCA |
|
|
Back to top |
|
|
spacebar How do I cheat? Reputation: 0
Joined: 23 Aug 2008 Posts: 7
|
Posted: Wed Mar 15, 2017 5:13 pm Post subject: |
|
|
ooo you're right. i am messing things up by linking to that code cave.
there is a jne just above the place where i inject that points to the value that gets moved to the code cave and thus does not exist at the place where it is expecting it.
Code: |
game.exe+B208F - 75 09 - jne game.exe+B209A
game.exe+B2091 - 83 3D F0D76500 00 - cmp dword ptr [game.exe+25D7F0],00 { [00000000] }
game.exe+B2098 - 74 0F - je game.exe+B20A9
game.exe+B209A - 8B 5D C8 - mov ebx,[ebp-38]
|
is it possible to move this whole part to the code cave with the auto assemble function?
Thanks!
|
|
Back to top |
|
|
++METHOS I post too much Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Wed Mar 15, 2017 5:18 pm Post subject: |
|
|
Yes -- just add the appropriate number of NOP's to your script and make sure that you include all of the code that you are wanting to relocate. You will want to make sure to restore it all in your disable section as well.
|
|
Back to top |
|
|
spacebar How do I cheat? Reputation: 0
Joined: 23 Aug 2008 Posts: 7
|
Posted: Wed Mar 15, 2017 5:20 pm Post subject: |
|
|
alright i'll try that. thx again.
|
|
Back to top |
|
|
++METHOS I post too much Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Wed Mar 15, 2017 5:35 pm Post subject: |
|
|
For example:
Code: | //Target: firefox.exe
//Author: ++METHOS
[ENABLE]
{==================== example ====================}
aobscanmodule(aob_example,firefox.exe,55 8B EC 8B 45 08 56 8B 48)
alloc(newmem_example,1024,firefox.exe)
label(return_example)
label(originalcode_example)
registersymbol(aob_example)
newmem_example:
originalcode_example:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push esi //Additional code
mov ecx,[eax+3C] //Additional code
add ecx,eax //Additional code
jmp return_example
aob_example:
jmp newmem_example
db 90 90 90 90 90 90 90 //Additional NOP's
return_example:
[DISABLE]
dealloc(newmem_example)
aob_example:
db 55 8B EC 8B 45 08 56 8B 48 3C 03 C8 //Additional Bytes
unregistersymbol(aob_example) |
|
|
Back to top |
|
|
|