| View previous topic :: View next topic |
| Author |
Message |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Tue Jul 21, 2009 2:36 pm Post subject: What are all the ways a program can jump to an opcode? |
|
|
I've been tracing the code to jump in a game by using breakpoints and seeing if the jump triggers it. I've followed it back from a function and through tons of assembly code but I've hit a spot where it has "int 3"s above it and I cannot find what line of code calls it.
How would I trace what Opcode "jmp"'ed to it. I've looked for all the variations of jmps and the opcodes.
je 10328383
jna 10328383
jnge 10328383
etc...
I've, of course, already tried to see if it was a function "call 10328383"
anyone have any clues?
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 26006 Location: The netherlands
|
Posted: Tue Jul 21, 2009 4:48 pm Post subject: |
|
|
If you use ce you could try the code dissector, it'll then write the code that jumps to there
Other jumps/calls:
| Code: |
call [0xxxxxxxxx] (0xxxxxxxxx=10328382)
|
| Code: |
jmp [0xxxxxxxxx] (0xxxxxxxxx=10328383)
|
Anyhow, have you made sure it's not a call function. (Set a breakpoint at the start and look at the location of esp)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Tue Jul 21, 2009 6:26 pm Post subject: |
|
|
Never used the code dissector
I tried it and it finished but didn't output anything.
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 26006 Location: The netherlands
|
Posted: Tue Jul 21, 2009 7:56 pm Post subject: |
|
|
it doesn't 'output' anything directly, but it does adjust the disassembler view by adding some data above lines that get jumped to
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
mStorm Expert Cheater
Reputation: 0
Joined: 21 Feb 2009 Posts: 107
|
Posted: Wed Jul 22, 2009 12:06 am Post subject: |
|
|
| All it does is highlight the instructions above it. Where is the extra information at? :[
|
|
| Back to top |
|
 |
&Vage Grandmaster Cheater Supreme
Reputation: 0
Joined: 25 Jul 2008 Posts: 1053
|
Posted: Wed Jul 22, 2009 2:31 pm Post subject: |
|
|
Try looking at the EDI or EDP register. Maybe the address is in the stack
|
|
| Back to top |
|
 |
Slugsnack Grandmaster Cheater Supreme
Reputation: 71
Joined: 24 Jan 2007 Posts: 1857
|
Posted: Wed Jul 22, 2009 2:54 pm Post subject: |
|
|
| ; wrote: | Try looking at the EDI or EDP register. Maybe the address is in the stack  |
what's EDP ? yeah i think edi is along the stack somewhere.. that's what i heard
|
|
| Back to top |
|
 |
&Vage Grandmaster Cheater Supreme
Reputation: 0
Joined: 25 Jul 2008 Posts: 1053
|
Posted: Wed Jul 22, 2009 3:31 pm Post subject: |
|
|
| Slugsnack wrote: | | ; wrote: | Try looking at the EDI or EDP register. Maybe the address is in the stack  |
what's EDP ? yeah i think edi is along the stack somewhere.. that's what i heard |
EBP I mean, oh yeah, PTRZ PZ.
|
|
| Back to top |
|
 |
Sean1337 Master Cheater
Reputation: 0
Joined: 04 May 2007 Posts: 478
|
Posted: Thu Jul 23, 2009 7:19 am Post subject: Re: What are all the ways a program can jump to an opcode? |
|
|
| mStorm wrote: | I've been tracing the code to jump in a game by using breakpoints and seeing if the jump triggers it. I've followed it back from a function and through tons of assembly code but I've hit a spot where it has "int 3"s above it and I cannot find what line of code calls it.
How would I trace what Opcode "jmp"'ed to it. I've looked for all the variations of jmps and the opcodes.
je 10328383
jna 10328383
jnge 10328383
etc...
I've, of course, already tried to see if it was a function "call 10328383"
anyone have any clues?  |
Select the entire function and copy paste it here.
Indicate which address you are looking at.
_________________
|
|
| Back to top |
|
 |
|