-1
 005A45A6 > \83FE 50 CMP ESI,50 ; Switch (cases 0..50) 
 005A45A9 0F87 79150000 JA AcroByte.005A5B28 
 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA 
005A45B6 . FA465A00 DD AcroByte.005A46FA; Switch table used at 005A45AF 
 005A45BA . 51475A00 DD AcroByte.005A4751 
 005A45BE . 7C475A00 DD      AcroByte.005A477C 
 005A45C2 . 8B475A00 DD AcroByte.005A478B 
 005A45C6 . 9A475A00 DD AcroByte.005A479A 
 005A45CA . A9475A00 DD AcroByte.005A47A9 
 005A45CE . D4475A00 DD AcroByte.005A47D4 
 005A45D2 . ED475A00 DD AcroByte.005A47ED 
 005A45D6 . 06485A00 DD AcroByte.005A4806 
 005A45DA . 4B485A00 DD AcroByte.005A484B 
 005A45DE . E8485A00 DD AcroByte.005A48E8 
 005A45E2 . 3A495A00 DD AcroByte.005A493A 
 005A45E6 . 8E495A00 DD AcroByte.005A498E 
 005A45EA . 9A495A00 DD AcroByte.005A499A 
 005A45EE . E1495A00 DD AcroByte.005A49E1 
 005A45F2 . 174A5A00 DD AcroByte.005A4A17 
 005A45F6 . 594A5A00 DD AcroByte.005A4A59 
 005A45FA . A34A5A00 DD AcroByte.005A4AA3 

I need help on the above code, the JUMP at address 005A45AF is associated with 005A46FA. I want it to be associated to 005A4AA3.

My question is can I modify DS:[ESI*4+5A45B6] to [ESI*4+5A4AA3] or the (4 between ESI and Address) also needs to be changed.

I really want to jump to 005A4AA3.

Please help it's memory not hardware I am patching

1 Answer 1

1

I really want to jump to 005A4AA3.

Patch the bytes at virtual address 005A45AF from FF 24 B5 B6 45 5A 00 to E9 EF 04 00 00 90 90.

My question is can I modify DS:[ESI*4+5A45B6] to [ESI*4+5A4AA3]

Yes, in which case you'd want to patch the bytes at virtual address 005A45AF from FF 24 B5 B6 45 5A 00 to FF 24 B5 A3 4A 5A 00.

1
  • I am sorry that I failed to mention this is a Case Switch Table from 0 to 50. So the JMP is currently using the Case 0. I wish I can make the JMP use Case 11. So I have tried Oct 6, 2015 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.