1

i'm reading the solution of an exercise ( keygen me ) and i found this :

Load OllyDbg, where EIP is located

EIP = 0x51BDE1

What does it means ?? and how can i find this ! Thanks

  • EIP is the actual address of running code. Keep doing well :) – Abr001am Jan 21 '18 at 0:56
4

To quote from the "X86 Assembly book" in WikiBooks:

The EIP (Extended Instruction Pointer) register contains the address of the next instruction to be executed if no branching is done.

EIP can only be read through the stack after a call instruction.

In other words, EIP tells the computer where to go next to execute the next command and controls the flow of a program.

This simple example shows the automatic addition to eip at every step (source):

eip+1      53                push    ebx
eip+4      8B 54 24 08       mov     edx, [esp+arg_0]
eip+2      31 DB             xor     ebx, ebx
eip+2      89 D3             mov     ebx, edx
eip+3      8D 42 07          lea     eax, [edx+7]
.....

To spot EIP in OllyDbg you just have to look at the right panel and you'll find where EIP is pointing to.

enter image description here

So, in your example EIP = 0x51BDE1, thus the address of the next instruction will be 0x51BDE1. From the sentence you quoted, it seems like the writer want you to do something on this address. By default, OllyDbg would show you EIP in the disassembly window so it would be easy to spot it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.