Problem with calls

Index > Main > Problem with calls

Author

Thread

Poppuff

Joined: 10 Jul 2012
Posts: 1

Poppuff 10 Jul 2012, 18:39

Hi i'm having an issue with the last version (dll)
When I write :

Code:

call 0097C790h

it compiles it as

Code:

 call near ptr 97C790h

How can I make it so that it compiles to what I write ? :/

10 Jul 2012, 18:39

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 10 Jul 2012, 20:41

Get raw with it:

Code:

push retaddr
jmp 0097C790h

10 Jul 2012, 20:41

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system

revolution 11 Jul 2012, 00:06

Poppuff wrote:

Code:
call 0097C790h    
it compiles it as
Code:
 call near ptr 97C790h    
How can I make it so that it compiles to what I write ? :/

You have to use indirect addressing. The x86 CPU doesn't have absolute immediate calling.

Code:

call [thing]
;...
thing dd 0097C790h

typedef: Using jmp won't help, it is still a relative jump.

11 Jul 2012, 00:06

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 11 Jul 2012, 00:45

revolution wrote:

Poppuff wrote:
Code:
call 0097C790h    
it compiles it as
Code:
 call near ptr 97C790h    
How can I make it so that it compiles to what I write ? :/
You have to use indirect addressing. The x86 CPU doesn't have absolute immediate calling.
Code:
call [thing]
;...
thing dd 0097C790h    
typedef: Using jmp won't help, it is still a relative jump.

How do you know it is? I thought of that but what if it's not in the "relative range"?

11 Jul 2012, 00:45

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system

revolution 11 Jul 2012, 01:41

typedef wrote:

How do you know it is? I thought of that but what if it's not in the "relative range"?

Relative range is +-2GB for 32-bit code, so the entire address space. If 64-bit code then you get an error when it is out of range.

11 Jul 2012, 01:41

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 11 Jul 2012, 02:44

revolution wrote:

typedef wrote:
How do you know it is? I thought of that but what if it's not in the "relative range"?
Relative range is +-2GB for 32-bit code, so the entire address space. If 64-bit code then you get an error when it is out of range.

lol. Just when I thought I graduated from this stuff. Damn you !

11 Jul 2012, 02:44

r22

Joined: 27 Dec 2004
Posts: 805

r22 11 Jul 2012, 13:19

The RETurn instruction uses absolute addressing.
EIP <- POP()

Code:

PUSH @f
PUSH 0097C790h
RET
@@:

11 Jul 2012, 13:19

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum