Assembly code.

Is it possible to NOP a line in CShell.dll from my hack?
for instance

Code:

#define addy //address of line in cshell that i wanna get rid of
DWORD CShell = (DWORD)GetModuleHandleA("CShell.dll");
      _asm 
{            
      NOP (CShell + addy)

}

This won't work.

Either you use *(BYTE*)(CShell + addy) = 0x90; without the inline assembler
or you do it like this :
__asm
{
PUSH EAX
MOV EAX, CShell
ADD EAX, addy
MOV BYTE PTR DS:[EAX], 0x90
POP EAX
}

Of course a NOP takes 1 Byte, so if you want to NOP a CALL (takes 5 Bytes, example E8 7F FF FF FF) you have to fill these 5 Bytes with 5 NOPs

Originally Posted by derh.acker

This won't work.

Either you use *(BYTE*)(CShell + addy) = 0x90; without the inline assembler
or you do it like this :
__asm
{
PUSH EAX
MOV EAX, CShell
ADD EAX, addy
MOV BYTE PTR DS:[EAX], 0x90
POP EAX
}

Of course a NOP takes 1 Byte, so if you want to NOP a CALL (takes 5 Bytes, example E8 7F FF FF FF) you have to fill these 5 Bytes with 5 NOPs

Say something is 4 bytes, can i do this: Is4Bytes[] = {0x90,0x90,0x90,0x90}
Then
MOV BYTE PTR DS:[EAX], Is4Bytes

use memset(nop_address, 0x90, nop_count);

Originally Posted by giniyat101

use memset(nop_address, 0x90, nop_count);

Once again, thank you so much

Assembly code.

Post a Reply

Similar Threads

Tags for this Thread