mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Fri Apr 03, 2015 10:34 am Post subject: |
|
|
Try this one (different hackpoint):
| Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
newmem:
cmp dword ptr [ecx+00004020],#1000
jl originalcode
mov edi,#1000
originalcode:
test eax,eax
mov [ecx+00004014],edi
jmp returnhere
"sotes.exe"+1A1BD:
jmp newmem
nop
nop
nop
returnhere:
[DISABLE]
dealloc(newmem)
"sotes.exe"+1A1BD:
test eax,eax
mov [ecx+00004014],edi
//Alt: db 85 C0 89 B9 14 40 00 00 |
| Rzzil wrote: | The different between my initial code and this one is only add one line
But it still worked. How did that affect "cmp" above
In my initial code I use | Code: | | mov [ecx+00004014],#1000 |
new one : | Code: | mov edi,#1000
mov [ecx+00004014],edi |
|
Because you didn't save CPU flags (pushfd), or you didn't set them again (by repeating test eax,eax)
the instruction at sotes.exe+1A1C7 will never jump (when the code only affects current money)
EDI register is copied to EDX just before.
So, instructions between sotes.exe+1A1C9 and sotes.exe+1A1D5 will be always executed. It will set value again.
There you can see EDX is used for this.
This is why changing EDI register "fixes" it. (it still can be buggy when the code affects something different than money)
But, the proper ways would be:
- save CPU flags, do compares, restore CPU flags
- re-do instruction which sets CPU flags, just before our hackpoint. Place that "repeated" instruction in "original" section.
- choose different hackpoint
_________________
|
|