3

I'm new to reverse engineering. I started off here and I was working on the first file "Muadib1.zip". I replaced E842000000 with 909090909090 in a hex editor, but it seems like it broke the exe. Any ideas why it's not working?

I also tried replacing the sequence with just 5 NOP's instead of 6 but the result was the same.

  • an E8 call without prefixes should be 5 bytes on x86 – Nordwald Oct 11 '17 at 5:05
  • is it ok if we revert the previous version of this post? It's a pity that we will close with such good answer from @Norwald – Paweł Łukasik Oct 21 '17 at 20:35
  • Die.234567767654454443344444433445555555555555455544 – user1232138 Oct 21 '17 at 22:48
9

The problem is: you are smashing the stack.

Lets look at the function you want to patch:

enter image description here

As you can see, it pushes four parameters to the stack and calls USER32!MessageBoxA. A quick look at its documentation shows us, it expects four parameters and utilizes the standard WINAPI calling convention (also known as __stdcall). One thing in its description is crucial to this case:

the callee cleans the stack

(You can also see the function does no cleanup itself, otherwise we could expect something like add esp, 16)

That means if we NOP-out the call, we have to NOP-out the function setup as well:

enter image description here

Kind regards

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.