What are you trying to do here?
Because I can tell you in advance that what you're planning is not the best way to go about it.
Since in the memory the hex number is reversed, how can I reverse it to its right order without too much hassle?
Here is how it is in CE:
As you can see I want to reverse "54B0F801" to "01F8B054".
And how I "retrieve" it from that position?
Even familiar landscapes will
reveal a different kind of beauty
if you change your viewpoint.
Where these new encounters
and new bonds will lead you...
Such dazzling golden days.
I, too, look forward to
what I might behold.
What are you trying to do here?
Because I can tell you in advance that what you're planning is not the best way to go about it.
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Jabberwock (08-19-2012)
I'm trying to retrieve an address. What do you mean it's not the best way?
I'm being assisted with a signature scanner.
Even familiar landscapes will
reveal a different kind of beauty
if you change your viewpoint.
Where these new encounters
and new bonds will lead you...
Such dazzling golden days.
I, too, look forward to
what I might behold.
If you want to read the bytes at that position you can just do so with a DWORD* pointer. The bytes will turn up in the right order (01f8b054).
EDIT:
I meant you can just use the bytes like you see them. The signature will be:
"\xa2\x54\xn0\xf8\x10" xxxxx
Last edited by .::SCHiM::.; 08-19-2012 at 11:29 AM.
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Jabberwock (08-19-2012)
And how I convert them to unsigned long?
Look, I have access to the bytes.
A_bytes[length] will output 54
A_bytes[length+1] will output BO
And so on.
What I need to do is reverse the bytes and return them as unsigned long, meaning the address.
Last edited by Jabberwock; 08-19-2012 at 12:03 PM.
Even familiar landscapes will
reveal a different kind of beauty
if you change your viewpoint.
Where these new encounters
and new bonds will lead you...
Such dazzling golden days.
I, too, look forward to
what I might behold.
unsinged long* s = (unsigned long*)&a_Bytes[ offset ];
There you have them. The bytes are 'reversed' to the right order by the mov instruction, this is hardware related there is no reason to try and reverse them in software. You should just use them as you see them. For more info search for big endian format, or little endian format.
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Jabberwock (08-19-2012)
Your code give me the address to the container of 54.
OK I understood what to do. Thanks
Last edited by Jabberwock; 08-19-2012 at 12:46 PM.
Even familiar landscapes will
reveal a different kind of beauty
if you change your viewpoint.
Where these new encounters
and new bonds will lead you...
Such dazzling golden days.
I, too, look forward to
what I might behold.
Windows is a little endian system, which is why it interprets dwords as a series of bytes where the last byte is the higher address and the first is the lower address. On a big endian system (some linux operating systems) it would be the other way around.
There are two types of tragedies in life. One is not getting what you want, the other is getting it.
If you wake up at a different time in a different place, could you wake up as a different person?
Linux uses that horrible at&t syntax too, it feels so counter intuitive to me :/ It's like doing:
5 = a int;
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
It's probably only because of GAS that everyone uses at&t in that crowd. Our preferences are basically determined by our experiences. Or maybe it's because all other assemblers were closed source
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
DWORD Add = ReverseDWORD( 0xAABBCCDD ); //output is 0xDDCCBBAACode:DWORD ReverseDWORD( DWORD Original ) { BYTE Inv[ 4 ] = { ( Original >> 24 ) & 0xFF, ( Original >> 16 ) & 0xFF, ( Original >> 8 ) & 0xFF, ( Original >> 0 ) & 0xFF }; return *( PDWORD )Inv; }
---- Here is a more reduced way of doing it inline with a macro.
DWORD Add = INVERSE_DWORD( 0xAABBCCDD );//output is 0xDDCCBBAACode:#define INVERSE_DWORD( Original ) ( ( DWORD )( ( ( ( ( Original >> 0 ) & 0xFF ) & 0xFF ) << 24 )|( ( ( ( Original >> 8 ) & 0xFF ) & 0xFF ) << 16 )|( ( ( ( Original >> 16 ) & 0xFF ) & 0xFF ) << 8 )|( ( ( Original >> 24 ) & 0xFF ) & 0xFF ) ) )
Last edited by ntKid; 08-19-2012 at 05:43 PM.
Jabberwock (08-20-2012)
I used AT&T Syntax for some time on university projects, and tbh I cant be bothered to switch to Intel syntax.
Its like you say, "Our preferences are basically determined by our experiences.".
Not saying it is better or worst.
Light travels faster than sound. That's why most people seem bright until you hear them speak.
You can close the thread now.
Last edited by Jabberwock; 08-20-2012 at 08:53 AM.
Even familiar landscapes will
reveal a different kind of beauty
if you change your viewpoint.
Where these new encounters
and new bonds will lead you...
Such dazzling golden days.
I, too, look forward to
what I might behold.
Closed and marked solved as requested.
Light travels faster than sound. That's why most people seem bright until you hear them speak.