Skip to main content
Reverse Engineering

Return to Question

formatting
Source Link
edit approved Aug 18, 2016 at 10:16
knx
edit approved Aug 18, 2016 at 10:16
knx
  • 1.3k
  • 1
  • 10
  • 26

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example

0x10 call eax

Say eaxeax contains 0x200x20 at that point, I want to add 0x100x10 to it so that the address that gets called is now 0x300x30.

What I tried doing was set a AddVectoredExceptionHandlerAddVectoredExceptionHandler and put an INT3INT3 on 0x100x10. When my exception handler gets called, I restore the original byte at 0x100x10. Then I add 0x100x10 to eaxeax and jump to ExceptionInfo->ContextRecord->Eip;ThisExceptionInfo->ContextRecord->Eip. This obviously doesn't work well because I never return to the OS.

Is there another way or is this even possible?

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example

0x10 call eax

Say eax contains 0x20 at that point, I want to add 0x10 to it so that the address that gets called is now 0x30.

What I tried doing was set a AddVectoredExceptionHandler and put an INT3 on 0x10. When my exception handler gets called, I restore the original byte at 0x10. Then I add 0x10 to eax and jump to ExceptionInfo->ContextRecord->Eip;This obviously doesn't work well because I never return to the OS.

Is there another way or is this even possible?

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example

0x10 call eax

Say eax contains 0x20 at that point, I want to add 0x10 to it so that the address that gets called is now 0x30.

What I tried doing was set a AddVectoredExceptionHandler and put an INT3 on 0x10. When my exception handler gets called, I restore the original byte at 0x10. Then I add 0x10 to eax and jump to ExceptionInfo->ContextRecord->Eip. This obviously doesn't work well because I never return to the OS.

Is there another way or is this even possible?

Source Link
Majiick
Majiick
  • 188
  • 1
  • 8

Is it possible to change the value of a register when a certain instruction is executed?

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example

0x10 call eax

Say eax contains 0x20 at that point, I want to add 0x10 to it so that the address that gets called is now 0x30.

What I tried doing was set a AddVectoredExceptionHandler and put an INT3 on 0x10. When my exception handler gets called, I restore the original byte at 0x10. Then I add 0x10 to eax and jump to ExceptionInfo->ContextRecord->Eip;This obviously doesn't work well because I never return to the OS.

Is there another way or is this even possible?