0

I am VERY new to reverse engineering but I find it fascinating. I want to change the following code:

cmp     [ebp+arg_0], 2  
jnz     short loc_41143B  

I would like to change the 2 to any other number, but when I try to change it to a 3 IDA says invalid operand size(s) when I use the edit assembly feature in IDA.

Why doesn't it accept say "cmp [ebp+arg_0], 3" ?

The source code says:

int main(int argc, char *argv[]) {
volatile int a = 0x0a;
volatile int b = 0x27;
volatile int c = 0x3b;
volatile int d = 0x63;
if (argc == 2) {
    a ^= 0x42;
    b ^= 0x42;
    c ^= 0x42;
    d ^= 0x42;
    printf("%c%c%c%c\n", a, b, c, d);
}
return 0;

}

3
  • 1
    (1) What are the source code bytes? (2) How did you try to change it? (Use edit to add this to your question, don't answer in a comment.)
    – Jongware
    Mar 4, 2018 at 11:14
  • You don't need to clear out much significant informations from beyond the inspected instruction if you expect much of an answer, more you excise boundaried from your code more we can't tell what's happening.
    – Abr001am
    Mar 5, 2018 at 0:01
  • Thanks... that's what I told my wife when she asked me what I wanted to eat. ;) Mar 6, 2018 at 1:06

1 Answer 1

1

So you don't use change assembly, you use change bytes in the IDA edit menu.

So if you want to go from 2 to 3 you change the bytes: Original:
83 7D 08 02 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B

Changed:
83 7D 08 03 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B

Also, if you want to change the argc == 2 to say argc > 2 then this changes:
jnz short loc_41143B to jle short loc_41143B

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.