|
Ok guys,
I got the intel instruction set reference and did a lot of reading so I understand the asm code a lot better now than i did before. Not completely yet but hopefully with time I will understand more. Thanks for the good advice, info and the links!
There's just 1 thing now that I can't figure out! I am using IDAPRO for my dissassembler and I have winhex as my hex editor.
I have read through the help of both programs extensively and I have searched google as well and I am still stumped! Probably something simple I'm missing.
My problem is that I can't figure out how to find the offset that I want to change in winhex. In IDA I found that I wanted to change a jz to a jmp at 60748BE5+45E. When I switch to the hex view in IDA i also see that same reference# and I see where the hex numbers are that I want to change. When I go to winhex to find that address I have no clue how to get there. It starts with all 0's then increments by 10 up to 232FF0. So I just need to know how to cross reference the address I see in IDA with the offset in winhex.
I got PEID and used it on the dll I am working on. For the subsystem it says "WIN32GUI" and below that it says "Microsoft Visual C++ 7.0 DLL Method 3". I would assume it is referring to the compiler that was used. Then I used it on the exe and it says the same thing for the subsystem and below it says "Nothing Found[Overlay]". Am I to assume that this program has no protection? It would seem strange if it didn't. I still don't know what protection my program uses if any at all.
Sorry for being so long winded and writing essays. Just trying to make sure everything is clear.
Thanks!
|