0

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory.

It seems that a jmp inside an instruction is used and I couldn't fix it to be able to continue my analysis.

Any help on this would be greatly appreciated !

enter image description here

enter image description here

Improve this question

1 Answer 1

Reset to default
2

There is no obfuscation here, it is a fairly standard jump to a fixed address.

Breaking it down:

FF 25 00 00 00 00        ; jmp  qword ptr [rip]
68 01 4A 00 00 00 00 00  ; dq   00000004A0168h

The first instruction says to read the value at RIP and then jump to that address. Since RIP is already advanced past the end of the instruction, the data value is in the 8 bytes following the jump (which happens to be the value 0x4A0168). So the code that executes next is at that virtual address.

Improve this answer
1
  • 1
    And the value following the jump is in little-endian ? How can I easily tell IDA to follow the jump ?
    – plowsec
    Commented Dec 2, 2017 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.