View Single Post
  #3  
Old 02-10-2004, 01:30
bartster
 
Posts: n/a
Thanks a lot for the help. I realy appreciate it. I have been doing a lot of reading and I did find some reference material that helped me out. I still have a few more questions about code that would be nice if I could figure out.

#1. What is the difference between "cmp" and "test"? I read about the operations and I still don't get it.

#2. This is the hardest thing for me to understand right now. I am having trouble figuring out whether or not conditional jumps are taken. I know that it goes by the result of what the previous operation was and whether or not a flag is set with a "1" or a "0", or the contents of some register is compared with a value. Comparing a hex# to a register is easy and I understand that and can determine if a jump is taken that way. I just can't figure out what the result of the test or cmp would be on my own. It is either the same or it isn't. When is it "0" and when is it "1"?

#3. Here is another example of what I don't understand. The jnz in the code below means jump short if not 0 to 604dfdd0. The operation right before that is a mov. How do you determine whether or not it is 0 from a mov? Maybe it refers to the test right before that and not the mov?

call SUB_L60431030
mov ebx,eax
test ebx,ebx
mov [esp+28h],ebx
jnz L6042FDD0
mov [esp+3Ch],al
jmp L6042FF4B

#4. What is the best program to use to modify the code of a dll or exe? I want to change some conditional jumps to unconditional jumps and some to nop too. I have all the programs you guys use and can't figure out which one can do that. All I can do right now is look at it.

#5. I know the prgram I'm working on has some sort of protection built into it. Is there a way that I can determine what protection a program uses? Whether it be armadillo or asprotect or acprotect or whatever. I need to read about the copy protection that my application uses so I can understand it better!

I sure would appreciate it if kythen or someone would take the time to explain this stuff.

Thanks alot!
Reply With Quote