thecreator Posted January 6, 2009 Share Posted January 6, 2009 Hi guys I'm sorry I'm such a noob and always have to ask these questions. I've been messing around with Olly Debugger to modify a programs execution flow. I want to be able to automate this process so I will need to understand this thing... I use a JMP instruction to go from the called function to mine. In ollydbg all i have to do is go to the function and enter "JMP 0040131A" and it will modify the memory accordingly for it to work. It turns out that in hex "JMP 0040131A" became "E9 D3EEBF83". I don't get how they get this. The only thing I understand is that E9 is the 'JMP rel32' instruction (from intels documentation). Ill dump the stuff i got from ollydbg. 7C802442 >-E9 D3EEBF83 JMP vic.0040131A "7C802442" - The memory location I am changing. (its the memory location for Sleep() in windows sp2) "E9 D3EEBF83" - What ollydbg makes **what i dont understand "JMP vic.0040131A" - just a summary of what the instruction does i guess tl/dr - how does "7C802442" + "JMP 0040131A" = "E9 D3EEBF83" ?? Help would be much appreciated. Quote Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.