0

I'm trying to mess around with an old game and I want to reposition a UI element.

I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) but it appears that because the 90 value is less than 128, the compiler optimized the assembly and changed the assembly from a push int (68 ? ? ? ?) to a push signed byte (6a ?).

This means that I'm unable to extend the X position beyond 128.

Is there any way for me to set the X position to something like 1000? I would need to somehow be able to change the assembly code to do a push int instead, correct? Will asm help me achieve that? Or what other methods could I use?

Here's what I'm talking: enter image description here

| improve this question | | | | |
2

As you mentioned, 0x6a is the instruction push Ib, in this case, the operand is encoded in only one byte and it's signed (i.e. 0x6a 0xff → push -1). You need to promote to the instruction 0x68 push Iz which means expand the instruction. Your choice is rather limited. I suggest you try to find some code cave and jump on it to setup the stack as you want.

To do so:

  • the first part is to find some free executable space. You might find that at the end of the .text section. Because of the alignment, you'll find some unused space padded with nop.
  • Once you find one, patch these pushes with a jmp to this location.
  • In this free space, you can freely encode your 0x68 pushes.
  • Finally, encode another jmp from this free space to jump back to the initial point.
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.