Re: Need a jump opcode generator.

Skybuck Flying wrote:

Hello,

It seems winsock 2 functions:

sendto, recvfrom, send, recv all start with the following 5 bytes according to Delphi's debugger:

71C02F7F 8BFF mov edi,edi
71C02F81 55 push ebp
71C02F82 8BEC mov ebp,esp

These bytes need to be replaced with a jump instruction which is supposed to jump to my interception routines.

It's ok to assume the address for the interception routines are located in a pointer (32 bit).

Now I need a generator which will generate the appriorate opcode / instruction encoding.

Prototype for the generator could be:

JumpGenerator( LocationAddress : pointer; JumpAddress : pointer );

The generator is supposed to create opcodes which would be placed at:

LocationAddress^

and jump to:

JumpAddress (the value is the address where the jump opcode is to jump too)

How many bytes will the jump take ?

For now I assume it takes 5 bytes just like a call.. but maybe it takes less bytes then a call ?

Anyway help would be great.

I'll to figure it out myself as well but the intel manual lists many possibilities... so gotta figure it out.

Only generating the opcode is needed, virtual protect and stuff like that is not needed.

Bye,
Skybuck.


They call it a stack frame.


--
"I'm never wrong, once i thought i was, but was mistaken"
Real Programmers Do things like this.
http://webpages.charter.net/jamie_5

.

Relevant Pages

  • Re: Need a jump opcode generator.
    ... These bytes need to be replaced with a jump instruction which is supposed ... It's ok to assume the address for the interception routines are located ... Now I need a generator which will generate the appriorate opcode / ... JumpAddress (the value is the address where the jump opcode is to jump ...
    (alt.comp.lang.borland-delphi)
  • Need a jump opcode generator.
    ... These bytes need to be replaced with a jump instruction which is supposed to ... jump to my interception routines. ... Now I need a generator which will generate the appriorate opcode / ... JumpAddress (the value is the address where the jump opcode is to jump ...
    (alt.comp.lang.borland-delphi)
  • Re: defered word options
    ... location, modify the opcode)? ... illegal instruction smaller than a jump and have it vector to your code. ... A related option for some architectures is to use a software interrupt ...
    (comp.lang.forth)
  • Re: OT: Electric current measuring device
    ... There is a big jump to go up ... I have a 2 ton AC upstairs and 3.5 downstairs. ... size a generator after the power outage Friday night. ... electrical loads without getting crazy by running a ton of stuff. ...
    (rec.games.pinball)
  • Re: AES has been broken
    ... Skybuck Flying wrote: ... > Had it been broken would you quit your job or jump of a building or ... Tom ...
    (sci.crypt)