so I have the .idb file of an executeable I want to modify.

In the IDB file, I found this code

enter image description here

And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to pseudocode, this is what it shows me

enter image description here

(marked in yellow)

So it shows 4121000 and 4111001 in these segments, but it doesn't show the rest and the one I want to change (4111006), preventing me from finding it in ollydbg / a hex editor and changing it.

Is it possible to find 4111006 and change it to a different integer value? If so, how can I do that? Thank you.

  • 1
    First you need to learn assemble language and understand how the decompiled code corresponds to the disassembly.
    – user202729
    Aug 21 '18 at 4:07
  • 3
    please do not post code as images. It's really hard to copy paste from them. Aug 21 '18 at 4:38

The way how those IFs are constructed in the assembly is a bit different than what you see in high-level overview in IDA code.

Apart from the first one, ifs are represented with subtraction (sub & dec) and jz.

This code is an alternative of conditions:

if (Args == 4121000 || Args == 4111001)
    goto LABEL_297

and is represented in asm with this code:

6DCC53: mov ecx, 4121000
6DCC55: cmp eax, ecx
6DCC57: jg short loc_6DCC93
6DCC5D: jz loc_6DCBB6
6DCC62: sub eax, 4111001
6DCC68: jz loc_6DCBB6

because in the first 4 lines (excluding 3rd) you have the first part of the if (standard cmp + jz) and then later a value of 4111001 is subtracted from eax. If it results in zero then we know that the value was equal to it and we jump to the same location. So IDA identifies this as an alternative of two values: 4121000, 4111001.

The following ifs are represented with this:

dec eax
jz loc_6DCXXX

Remember that after the line 6DCC62 the value in eax we compare with is already -4111001, so if we subtract one more time and if we get zero, we know that the initial value was 4111002. This is why IDA represents this as:

if (Args == 4111002)
    goto LABEL_346

The next branches are the same. So you if want to modify the last one, you would have to modify the line that IDA correctly pointed you to + the one before. So instead of having there the same pattern as for all the other ifs, you need to write:

cmp ecx, 1006
jz 6DCD28

and assemble such opcodes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.