nopping engine crashcode; finding pointer?
Hi,
After my last thread getting some help on finding the EU pointer and writing my own console (thanks guys) i was told to find the crash code to null it as that's the problem i was facing.
My knowledge of ASM is limited so i've been having some issues.
Firstly, is it the engine.dll file we're working on here? Just to make sure i'm in the right place!
Secondly, if this is the case, i assume we're working on the "__security_init_cookie" routine? I'm assuming we can't just nop the call to this function and everything is ok, so we have to be clever about it?
I counted 9 "blocks" the execution could go through, with a main chunk doing a performance test that apparently checks for buffer overrun. Is it the jump at the end of this we need to change (i.e. JNZ to JZ) ... alternatively could we change the comparison (CMP esi,edi) to CMP esi,esi or CMP edi,edi which will always return correct?
I also noticed a few hard coded values for the checks ... wouldn't that make it possible (if you were bored) to add your DLL size to the value so that once injected, it can't be detected by the program? ... Just a thought (i know it'd be pointless and tedious).
Am i on the right lines? right file, right procedure, right sort of area? Or am i completely wrong?
Sorry if these questions are stupid. I've not looked at ASM for 4 years and i never got into any depth with it.
Thanks for any help!
After my last thread getting some help on finding the EU pointer and writing my own console (thanks guys) i was told to find the crash code to null it as that's the problem i was facing.
My knowledge of ASM is limited so i've been having some issues.
Firstly, is it the engine.dll file we're working on here? Just to make sure i'm in the right place!
Secondly, if this is the case, i assume we're working on the "__security_init_cookie" routine? I'm assuming we can't just nop the call to this function and everything is ok, so we have to be clever about it?
I counted 9 "blocks" the execution could go through, with a main chunk doing a performance test that apparently checks for buffer overrun. Is it the jump at the end of this we need to change (i.e. JNZ to JZ) ... alternatively could we change the comparison (CMP esi,edi) to CMP esi,esi or CMP edi,edi which will always return correct?
I also noticed a few hard coded values for the checks ... wouldn't that make it possible (if you were bored) to add your DLL size to the value so that once injected, it can't be detected by the program? ... Just a thought (i know it'd be pointless and tedious).
Am i on the right lines? right file, right procedure, right sort of area? Or am i completely wrong?
Sorry if these questions are stupid. I've not looked at ASM for 4 years and i never got into any depth with it.
Thanks for any help!
Originally Posted by jammiey2k3
