Skip to main content
More capitalization at the beginning of sentences, less in the middle
Source Link

I am Not Sure What Your Intentnot sure what your intent is.

ifIf you mean you have to add a function and call it before main after the source is compiled

 , then yes it is definitely possible
all. All you have to do is run through some hoops like finding a code cave  , assembling the new code in code cave  , and detouring the first instruction of main to call your new function and return back to mainsmain's next instruction.

ifIf you mean iI want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough  ).

andAnd no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

havingHaving source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable.

aA program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

youYou may need to implement the commented out source code inline for decrypting

afterAfter you implement your decrypt proc some where in existing free space (called code cave) it may look like this

nowNow you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

I am Not Sure What Your Intent is

if you mean you have to add a function and call it before main after the source is compiled

  then yes it is definitely possible
all you have to do is run through some hoops like finding a code cave  , assembling the new code in code cave  , and detouring the first instruction of main to call your new function and return back to mains next instruction

if you mean i want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough  )

and no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable

a program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

you may need to implement the commented out source code inline for decrypting

after you implement your decrypt proc some where in existing free space (called code cave) it may look like this

now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

I am not sure what your intent is.

If you mean you have to add a function and call it before main after the source is compiled, then yes it is definitely possible. All you have to do is run through some hoops like finding a code cave, assembling the new code in code cave, and detouring the first instruction of main to call your new function and return back to main's next instruction.

If you mean I want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough).

And no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

Having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable.

A program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

You may need to implement the commented out source code inline for decrypting

After you implement your decrypt proc some where in existing free space (called code cave) it may look like this

Now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

added 815 characters in body
Source Link
blabb
  • 16.7k
  • 1
  • 15
  • 30

then yes it is definitely possible
all you have to do is run through some hoops like finding a code cave , assembling the new code in code cave , and detouring the first instruction of main to call the your new function and return back to mains next instruction

if you mean i want the function to be sequential then it might be possible if you can destroy and recreate the assembly inplacein-place (kinda tough )

you may need to implement the commented out srcsource code inline for decrypting

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

.code
start:
    ;call decrypt
    call hello
    invoke ExitProcess,NULL
    
; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp
    
    
hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
    ret
hello endp 

end start

after you implement your decrypt proc some where in existing free space (called code cave) it may look like this

now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

CPU Disasm
Address       Command                                            Comments
00152000      XOR     ECX, ECX
00152002      /LEA     ESI, [154000]
00152008      |ADD     ESI, ECX
0015200A      |MOVZX   EAX, BYTE PTR DS:[ESI]
0015200D      |XOR     EAX, 00000090
00152012      |MOV     BYTE PTR DS:[ECX+154000], AL
00152018      |ADD     ECX, 1
0015201B      |CMP     BYTE PTR DS:[ECX+153FFF], 0
00152022      \JNE     SHORT 00152002
00152024      RETN

then yes it is definitely possible
all you have to do is run through some hoops like finding a code cave , assembling the new code in code cave , and detouring the first instruction of main to call the your function and return back to mains next instruction

if you mean i want the function to be sequential then it might be possible if you can destroy and recreate the assembly inplace (kinda tough )

you may need to implement the commented out src code inline for decrypting

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

.code
start:
    ;call decrypt
    call hello
    invoke ExitProcess,NULL
    
; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp
    
    
hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
    ret
hello endp 

end start

then yes it is definitely possible
all you have to do is run through some hoops like finding a code cave , assembling the new code in code cave , and detouring the first instruction of main to call your new function and return back to mains next instruction

if you mean i want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough )

you may need to implement the commented out source code inline for decrypting

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

.code
start:
    ;call decrypt
    call hello
    invoke ExitProcess,NULL
    
; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp
    
    
hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
    ret
hello endp 

end start

after you implement your decrypt proc some where in existing free space (called code cave) it may look like this

now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

CPU Disasm
Address       Command                                            Comments
00152000      XOR     ECX, ECX
00152002      /LEA     ESI, [154000]
00152008      |ADD     ESI, ECX
0015200A      |MOVZX   EAX, BYTE PTR DS:[ESI]
0015200D      |XOR     EAX, 00000090
00152012      |MOV     BYTE PTR DS:[ECX+154000], AL
00152018      |ADD     ECX, 1
0015201B      |CMP     BYTE PTR DS:[ECX+153FFF], 0
00152022      \JNE     SHORT 00152002
00152024      RETN
Source Link
blabb
  • 16.7k
  • 1
  • 15
  • 30

I am Not Sure What Your Intent is

if you mean you have to add a function and call it before main after the source is compiled

then yes it is definitely possible
all you have to do is run through some hoops like finding a code cave , assembling the new code in code cave , and detouring the first instruction of main to call the your function and return back to mains next instruction

if you mean i want the function to be sequential then it might be possible if you can destroy and recreate the assembly inplace (kinda tough )

and no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable

a program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

enter image description here

you may need to implement the commented out src code inline for decrypting

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

.code
start:
    ;call decrypt
    call hello
    invoke ExitProcess,NULL
    
; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp
    
    
hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
    ret
hello endp 

end start