Redouane Master Cheater
Reputation: 3
Joined: 05 Sep 2013 Posts: 363 Location: Algeria
|
Posted: Wed Jul 02, 2014 4:14 pm Post subject: Small bug |
|
|
In the auto assembler,sometimes,when you specify a symbol but not its module,it may not inject code successfully:
example code:
Code: | msvcrt.exit:
ret
db 90 |
After this,go to the memory viewer,rightclick,choose goto,and type in msvcrt.exit,now,after reclicking 'goto',try typing in the word exit,the bytes are different,in the first one you will see a ret followed by a nop,everything is fine,but in the second one,you'll notice a 'mov edi,edi',this because the symbol handler does not make a difference between msvcrt.exit and msvcrt._exit,it spells both of them as exit.
More details in attachments.
Description: |
|
Filesize: |
9.02 KB |
Viewed: |
6044 Time(s) |

|
Description: |
|
Filesize: |
39.85 KB |
Viewed: |
6044 Time(s) |

|
|
|