| View previous topic :: View next topic |
| Author |
Message |
AwayTheWInd
Master Cheater
![]() Reputation: 0
Joined: 11 Sep 2007
Posts: 450
|
 Posted: Mon Mar 31, 2008 4:56 pm Post subject: [questions] |
 |
|
1. in AA(auto-assembly) how can u do this?
(script)
00xxxxxx:
push 00
(script end)
what does that mean exactly? does it mean give the address 00xxxxxx the value of 00?
2. how can u do an array of bytes in C++?
3.in AA(auto-assembly) what does this mean?
(script)
00xxxxxx:
jae/je/jmp/jb/ja/jbe 00xxxxxx(different address)
(script end)
does that mean if ?(according to the type of jmp) set the value of the jmped address to the original one?
4. is all AA(auto-assembly) in HEX? so like 52 is 82?
ty if u can answer me
_________________
|
|
| Back to top |
|
 |
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Mon Mar 31, 2008 10:42 pm Post subject: |
|
|
1. When you write a script and use the method you showed above:
This means to write the code 'push 00' at that address.
2. You can do an array of bytes like:
BYTE bArray[] = {0x90, 0x90, 0x90, 0x90};
Add onto or remove some if you need to, change the nop bytes to what ever bytes you need inside the array. You can obtain the array size by using sizeof( bArray ) then as well.
3. Each of those are different jumps. Mind you the 2nd part of a jump is not an address in the same sense as you look at it. It is a calculated offset. (To - From)
Again thought, that also means at the given address, write that code.
4. Yes.
_________________
- Retired. |
|
| Back to top |
|
|
AwayTheWInd
Master Cheater
![]() Reputation: 0
Joined: 11 Sep 2007
Posts: 450
|
| Posted: Tue Apr 01, 2008 2:40 pm Post subject: |
|
|
ty wicaan but so my 3rd question... what does it do to the (value of the) previous address? +rep
_________________
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Tue Apr 01, 2008 5:23 pm Post subject: |
|
|
When you write something like:
1005000:
jmp 1005010
This will write the bytes of the opcode 'jmp' to the address of 1005000 along with the calculated offset for the jump, which in this case is 14 bytes. So it would write this to 1005000:
EB 0E
EB representing the 'short jump' and 0E (being 14) as the offset to jump.
_________________
- Retired. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
