Finding Bytes

Posts 14 of 4 · Page 1 of 1
Finding Bytes
When I search an address in cshell i dont find it. Im using ollydbg
http://screensnapr.com/e/k3Kom7.png
Look at the image above.

Let's say the address you're looking for is 0x377A6DA0. (The 2nd address in the picture)
You see the letters/words next to it? Those are your off-bytes.
so for 0x377A6DA0, the off-bytes are: F88F7D00. (<- that's 4 bytes long)
just separate them "properly", like so:
\xF8\x8F\x7D\x00
^
That's your off bytes! Now usually to find the on-bytes, you just NOP it. (Not always that way though)
NOP = No Operation, which is \x90.
Since there are 4 bytes, you would just NOP the 4 bytes to get your on-bytes:
\x90\x90\x90\x90
so for 0x377A6DA0
Off: \xF8\x8F\x7D\x00
On: \x90\x90\x90\x90

(The address isn't useful, I just got the pic from a different thread and cropped a few addresses out.)

Hope you learned something!
If you aren't finding anything when you search it's a bad dump....
Try using IDA, it's more new hack user friendly. Load up the dump, hit 'G' and enter your address and you're on your way.
Look at the "Tips and tricks" section in this thread for finding off bytes manually if that's the method you prefer.
Posts 14 of 4 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Need help?