View Single Post
  #1  
Old 02-11-2004, 02:19
bartster
 
Posts: n/a
Ok guys,

I got the intel instruction set reference and did a lot of reading so I understand the asm code a lot better now than i did before. Not completely yet but hopefully with time I will understand more. Thanks for the good advice, info and the links!

There's just 1 thing now that I can't figure out! I am using IDAPRO for my dissassembler and I have winhex as my hex editor.
I have read through the help of both programs extensively and I have searched google as well and I am still stumped! Probably something simple I'm missing.

My problem is that I can't figure out how to find the offset that I want to change in winhex. In IDA I found that I wanted to change a jz to a jmp at 60748BE5+45E. When I switch to the hex view in IDA i also see that same reference# and I see where the hex numbers are that I want to change. When I go to winhex to find that address I have no clue how to get there. It starts with all 0's then increments by 10 up to 232FF0. So I just need to know how to cross reference the address I see in IDA with the offset in winhex.

I got PEID and used it on the dll I am working on. For the subsystem it says "WIN32GUI" and below that it says "Microsoft Visual C++ 7.0 DLL Method 3". I would assume it is referring to the compiler that was used. Then I used it on the exe and it says the same thing for the subsystem and below it says "Nothing Found[Overlay]". Am I to assume that this program has no protection? It would seem strange if it didn't. I still don't know what protection my program uses if any at all.

Sorry for being so long winded and writing essays. Just trying to make sure everything is clear.

Thanks!
Reply With Quote