| View previous topic :: View next topic |
| Author |
Message |
Overload
Master Cheater
 Reputation: 0
Joined: 08 Feb 2008
Posts: 293
|
 Posted: Tue Jun 03, 2008 10:43 pm Post subject: ASM/C Help |
 |
|
Is it possible to add a script like this into a C code?
| Code: | [enable]
01002ff5:
nop
[disable]
01002ff5:
inc [0100579c]
|
For example, i just want to make a basic program to stop the timer on minesweeper when they type in stop time. Just something along those lines...
And yea, i've never tried using assembly with C/C++ before...So its probably a really dumb question 
|
|
| Back to top |
|
 |
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Tue Jun 03, 2008 10:49 pm Post subject: |
|
|
#define addy = 01002ff5
(DWORD*)addy = 0x90;
_________________
|
|
| Back to top |
|
|
nwongfeiying
Grandmaster Cheater
![]() Reputation: 2
Joined: 25 Jun 2007
Posts: 695
|
| Posted: Tue Jun 03, 2008 10:50 pm Post subject: |
|
|
| Wild guess from me, but writeprocessmemory or use _asm.
|
|
| Back to top |
|
|
Overload
Master Cheater
Reputation: 0
Joined: 08 Feb 2008
Posts: 293
|
| Posted: Tue Jun 03, 2008 11:31 pm Post subject: |
|
|
| nwongfeiying wrote: | | Wild guess from me, but writeprocessmemory or use _asm. |
i did used the __asm.
But @ HalfPrime, right, i never though to do it in hex...xD (the 0x90 for nop i mean).
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Wed Jun 04, 2008 1:47 am Post subject: |
|
|
| Use WriteProcessMemory and write 0x90 to (void*)0x01002ff5.
|
|
| Back to top |
|
|
Symbol
I'm a spammer
![]() Reputation: 0
Joined: 18 Apr 2007
Posts: 5094
Location: Israel.
|
| Posted: Wed Jun 04, 2008 2:40 am Post subject: |
|
|
| Isn't "inc [address]" 5-6 bytes?
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Wed Jun 04, 2008 6:02 am Post subject: |
|
|
You have to nop out all the bytes for that command, so make sure you know how many bytes that command contains and then nop our all of them
*(BYTE*)Addy = ByteToChangeTo;
*(WORD*)Addy = 2BytesToChangeTo;
*(DWORD*)Addy = 4BytesToChangeTo;
for example if you actually only had 1 byte like up there it would be
*(BYTE*)0x01002ff5 = 0x90;
This is of course if you have access to the memory space via DLL Injection of some sort.
Else use WriteProcessMemory like someone said above.
_________________
|
|
| Back to top |
|
|
Overload
Master Cheater
Reputation: 0
Joined: 08 Feb 2008
Posts: 293
|
| Posted: Wed Jun 04, 2008 9:42 am Post subject: |
|
|
| Okay, thanks a lot you guys =)
|
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Wed Jun 04, 2008 10:51 am Post subject: |
|
|
| Code: | | 01002FF5 - ff 05 9c 57 00 01 - inc [0100579c] : 00000000 |
If you are injecting a DLL you can use pointers or memcpy, if not you can use WriteProcessMemory. Being that you are trying to fully nop this instruction, you need to use 6 nops instead of only 1.
To overwrite this with WriteProcessMemory you could use:
| Code: | BYTE bNopBytes[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
WriteProcessMemory( hHandle, (BYTE*)0x01002FF5, &bNopBytes, sizeof(bNopBytes), NULL ); |
Then with pointers and memcpy if injected, you could use:
| Code: | BYTE bNopBytes[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
memcpy( (BYTE*)0x01002FF5, &bNopBytes, sizeof(bNopBytes) ); |
or
| Code: | BYTE* bAddr = (BYTE*)0x01002FF5;
*(BYTE*)bAddr = 0x90
*(BYTE*)(bAddr+1) = 0x90
*(BYTE*)(bAddr+2) = 0x90
*(BYTE*)(bAddr+3) = 0x90
*(BYTE*)(bAddr+4) = 0x90
*(BYTE*)(bAddr+5) = 0x90 |
_________________
- Retired. |
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Wed Jun 04, 2008 4:56 pm Post subject: |
|
|
| x0r wrote: | | Wiccaan wrote: | Then with pointers and memcpy if injected, you could use:
| Code: | BYTE bNopBytes[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
memcpy( (BYTE*)0x01002FF5, &bNopBytes, sizeof(bNopBytes) ); |
|
I'd suggest memset for something such as NOPing. |
To which I would have to suggest the intrinsic function __stosb(). 
|
|
| Back to top |
|
|
Overload
Master Cheater
Reputation: 0
Joined: 08 Feb 2008
Posts: 293
|
| Posted: Wed Jun 04, 2008 6:28 pm Post subject: |
|
|
| Okay, thanks a lot x0r and Wiccaan. I'll take a lot at both functions, compare them, and see which one i like more.
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Wed Jun 04, 2008 9:24 pm Post subject: |
|
|
| x0r wrote: | | Flyte wrote: | | To which I would have to suggest the intrinsic function __stosb(). |
Decided to make a quick test application:
| Code: | Started at 1484575914218610 ticks.
Allocated one megabyte at 0x00410020.
Now attempting to __stosb the region...
__stosb start = 1484575916450950
__stosb end = 1484575917612640
__stosb time = 1161690
Now attempting to memset the region...
memset start = 1484575918451160
memset end = 1484575918730690
memset time = 279530 |
|
One megabyte, that's not a biased test at all. 
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Wed Jun 04, 2008 9:24 pm Post subject: |
|
|
My suggestion of memcpy was showing how to write a byte array. Not specifically for nopping. Which he will probably land up using later down the road for other editing.
_________________
- Retired. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
