|
well if the CC is in the middle of the instruccion never will be executed how INT3 and is false,
there are CC is the middle of instructions
look this instruction by example
00635943 ^\72 CC JB SHORT BioSuite.00635911
there are a CC but the nanomite need generate a exception but in this position never generate a exception, the command is a conditional jump and when you execute the line a conditional jump wiil be executed not a INT3
other example
00635933 8D4484 CC LEA EAX,DWORD PTR SS:[ESP+EAX*4-34]
if the code near the instruction is correct the CC in this line never generate a exception and is a false nanomite.
Ricardo Narvaja
|