Byte calculation problem

Index > Main > Byte calculation problem

Author

Thread

DarkLordTed

Joined: 25 Nov 2017
Posts: 14

DarkLordTed 25 Nov 2017, 10:56

Sorry for my question but I have problem with this row of my code:

mov byte [.......],(00h - (.m1-.a1))

I really need to calculate SHORT JMP address .m1-.a1 is calculate correctly but if I set 00h - (.m1-.a1) result is NOT expected. Can you anybody tell me what is correct syntax for this in FASM?

Thank you!

25 Nov 2017, 10:56

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8351
Location: Kraków, Poland

Tomasz Grysztar 25 Nov 2017, 12:08

I quickly patched up an example of how to modify "jmp there" so that it becomes "jmp here":

Code:

        mov     byte [__jump+1], here - __after_jump

__jump:
        jmp     short there
__after_jump:

Is this what you're looking for?

25 Nov 2017, 12:08

DarkLordTed

Joined: 25 Nov 2017
Posts: 14

DarkLordTed 25 Nov 2017, 12:28

not exactly but is similar:

mov byte [_jump+1], (00h - (_jump - _jump_to))

_jump_to:
.....
....
_jmp_old:
....
...
_jump:

jne _jmp_old

25 Nov 2017, 12:28

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8351
Location: Kraków, Poland

Tomasz Grysztar 25 Nov 2017, 12:38

The jump offset is relative to the instruction pointer AFTER the jump instruction, not before. So this should be either:

Code:

        mov     byte [_jump+1], _jump_to - _after_jump

Code:

        mov     byte [_jump+1], _jump_to - (_jump+2)

And please be careful and ensure that the jump you modify is the SHORT jump. With NEAR one the offsets and sizes are different.

25 Nov 2017, 12:38

DarkLordTed

Joined: 25 Nov 2017
Posts: 14

DarkLordTed 25 Nov 2017, 12:49

Thank you! But the result is absolutely the same. I do not understand what happens. Is this possible to be OllyDbg problem? When code execution comes to that line, it can not continue - it does not hang, but repeatedly stays in this row. The code segment is readable, writable and executable, the error state is SUCCESS but ....

25 Nov 2017, 12:49

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system

revolution 25 Nov 2017, 14:07

What are the bytes of the jmp? Is your jmp going back to itself with the distance encoded to 0xfe?

25 Nov 2017, 14:07

DarkLordTed

Joined: 25 Nov 2017
Posts: 14

DarkLordTed 26 Nov 2017, 18:14

Thank you, everybody! My mistake! The calculation is correct!

26 Nov 2017, 18:14

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum