View Single Post
  #4  
Old 11-18-2005, 00:23
netxman
 
Posts: n/a
OK,let me clarify what I mean.Maybe I misused the word OEP.
A normal app has its entrypoint,I just want to move this entrypiont to the middle of its code,then jmp back to the original place where follow this EP.For example.

1 push ebp
2 mov ebp,esp
3 PUSH -1
4 PUSH 0
5 PUSH 0
6 0000
7 0000
8 0000
9 0000
10 MOV EAX,DWORD PTR FS:[0]
11 PUSH EAX
12 MOV DWORD PTR FS:[0],ESP
13 SUB ESP,68

0000 means null code.
Can I put the first line (push ebp) into line 6,then jmp back to line 2 in line 7?
6 push ebp
7 jmp 2
In this example it's absolutely infinite loop,right ? Because everytime it runs into line7 it will jump back. I am not sure if PE file running as I think maybe it's a stupid question.

diablo2oo2,yes it's easy to change the entrypoint but where you put the changed EP ? In the first section ? In the middle ? Or in the end? That's what I want to know.

Thanks.
Reply With Quote