0

I am VERY new to reverse engineering but I find it fascinating. I want to change the following code:

cmp     [ebp+arg_0], 2  
jnz     short loc_41143B  

I would like to change the 2 to any other number, but when I try to change it to a 3 IDA says invalid operand size(s) when I use the edit assembly feature in IDA.

Why doesn't it accept say "cmp [ebp+arg_0], 3" ?

The source code says:

int main(int argc, char *argv[]) {
volatile int a = 0x0a;
volatile int b = 0x27;
volatile int c = 0x3b;
volatile int d = 0x63;
if (argc == 2) {
    a ^= 0x42;
    b ^= 0x42;
    c ^= 0x42;
    d ^= 0x42;
    printf("%c%c%c%c\n", a, b, c, d);
}
return 0;

}

  • 1
    (1) What are the source code bytes? (2) How did you try to change it? (Use edit to add this to your question, don't answer in a comment.) – usr2564301 Mar 4 '18 at 11:14
  • You don't need to clear out much significant informations from beyond the inspected instruction if you expect much of an answer, more you excise boundaried from your code more we can't tell what's happening. – Abr001am Mar 5 '18 at 0:01
  • Thanks... that's what I told my wife when she asked me what I wanted to eat. ;) – user1713462 Mar 6 '18 at 1:06
1

So you don't use change assembly, you use change bytes in the IDA edit menu.

So if you want to go from 2 to 3 you change the bytes: Original:
83 7D 08 02 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B

Changed:
83 7D 08 03 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B

Also, if you want to change the argc == 2 to say argc > 2 then this changes:
jnz short loc_41143B to jle short loc_41143B

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.