I've reverse engineering little game on windows 32bit.

I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move on the board).

Interesting memory address

You can see that in the string is moved into eax. But more interesting part here is instruction before that

mov ebx,eax

Here ebx will contain the coordinate of a move which player made. This is what I'm interested about. I want to dump this coordinate into a file. So what I want to do is to modify assembly(in my case this code is in dll) and just write that data(which is in ebx) into a file.

I've done a little research but could not found anything useful. All I found is how to patch an executable like make a slightest modifications into assembly which is pretty simple. I was even wondering if there is any tool that could help me achieve this(like shift assembly code to make enough space for me to write some code in it).

One idea that I have is to write a shellcode which dumps data, then add that shellcode at the end of some section, find my string into .txt section, edit the code to jump to my shellcode and then back to original state. But that would be pretty hard because I'm not really experienced in writing shellcode.

  • 1
    What about setting a breakpoint there and reading ebx value? – bart1e Jul 7 '19 at 16:04
  • I want to launch application normally without a debugger and I want it to dump the data. – Ojs Jul 7 '19 at 16:11
  • Are you able to upload the executable? – bart1e Jul 7 '19 at 16:12
  • 1
    You may try Cheat Engine. It enables you to write scripts that could dump the data you want, but if you want the DLL to do this for you, patching will be the only option. – bart1e Jul 7 '19 at 16:21
  • 2
    @Ojs Binary Ninja (incl. the demo version) has a shellcode compiler. You can use that to write a short C snippet to do what you want and it would emit the corresponding assembly instructions. scc.binary.ninja – 0xec Jul 7 '19 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.