[HELP]FindPattern
[HELP]Find siggy mask
EDIT: Can some1 tell me how to find the mask of a siggy
I find this one to be a good example:
"Think of this like a detour in the road: if you're driving to your mall, and there's a construction site going on, you'll usually be taken down a detour. However, you'll still arrive at the mall, just through a different means" By someone at another forum.
"Think of this like a detour in the road: if you're driving to your mall, and there's a construction site going on, you'll usually be taken down a detour. However, you'll still arrive at the mall, just through a different means" By someone at another forum.
Originally Posted by 'Bruno
I find this one to be a good example:
"Think of this like a detour in the road: if you're driving to your mall, and there's a construction site going on, you'll usually be taken down a detour. However, you'll still arrive at the mall, just through a different means" By someone at another forum.
"Think of this like a detour in the road: if you're driving to your mall, and there's a construction site going on, you'll usually be taken down a detour. However, you'll still arrive at the mall, just through a different means" By someone at another forum.
Detours - Microsoft Research
EDIT: Oh never mind. I found out what it is.
Originally Posted by ♪~ ᕕ(ᐛ)ᕗ
umm, idk I didn't understood anything, are we talking about the same detours? I mean this:
Detours - Microsoft Research
EDIT: Oh never mind. I found out what it is.
And i answered with a simple definition to explain what the name exactly is.
And this is on the link that you posted:
Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.
Or maybe i'm just misunderstanding what you asked. (probably that, as i wasn't talking about the api) Just meh.. I'm probabily not explaining myself correctly, and confusing you and me.
Originally Posted by 'Bruno
You were talking about the library, but you also asked what is a detour(i guess you asked, an hook).
And i answered with a simple definition to explain what the name exactly is.
And this is on the link that you posted:
It's talking about the api, but still, it explains what is does.(hook?)
Or maybe i'm just misunderstanding what you asked. (probably that, as i wasn't talking about the api) Just meh.. I'm probabily not explaining myself correctly, and confusing you and me.
And i answered with a simple definition to explain what the name exactly is.
And this is on the link that you posted:
It's talking about the api, but still, it explains what is does.(hook?)
Or maybe i'm just misunderstanding what you asked. (probably that, as i wasn't talking about the api) Just meh.. I'm probabily not explaining myself correctly, and confusing you and me.
HUH?
NVM....
Can some1 tell me how to find the mask of a siggy?
Originally Posted by ♪~ ᕕ(ᐛ)ᕗ
I did understood. But now I need the FindPattern Function....
HUH?
NVM....
Can some1 tell me how to find the mask of a siggy?
Originally Posted by freedompeace
Take your address. Look at what bytes there are, look at the surrounding code, and select bytes that will not change.
Code:
JMP 006658874
Code:
EB ??
Code:
xx??
Uhm you're supposed to be using Array Of Bytes as a signature. Not ASM code from CE.
0xFF = Byte required
0x00 = Byte optional
That's now people normally use masks anyway.
But one question, what exactly are you trying to do? Are you trying to find an address via a pattern finder?
0xFF = Byte required
0x00 = Byte optional
That's now people normally use masks anyway.
But one question, what exactly are you trying to do? Are you trying to find an address via a pattern finder?
jmp 12345678 looks like \xEB\x78\x56\x34\x12
since only 0xEB is static:
sig: "\xEB\x00\x00\x00\x00"
mask: "x????"
since only 0xEB is static:
sig: "\xEB\x00\x00\x00\x00"
mask: "x????"
Originally Posted by Hell_Demon
jmp 12345678 looks like \xEB\x78\x56\x34\x12
since only 0xEB is static:
sig: "\xEB\x00\x00\x00\x00"
mask: "x????"
since only 0xEB is static:
sig: "\xEB\x00\x00\x00\x00"
mask: "x????"
so in masks:
x = Fixed Byte
? = Variable Byte
^^
Well thanks HD and master.