4

I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.

For example:

unsigned int addr = 0x0048DA03;
unsigned int jumpToAddr = 0x0048D9B2;
unsigned char command[] = { 0xEA };
WriteProcessMemory(hProcess, (void*)addr, (void*)command, sizeof(command), NULL); // this line for jmp
WriteProcessMemory(hProcess, (void*)addr, (void*)jumpToAddr, sizeof(jumpToAddr), NULL); // this line for the address

The result:

As you see, after executing that code, the jump address is wrong.

Also, the same problem occurs with the following code:

void* reservedMemAddress = VirtualAllocEx(hProcess, NULL, 100, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (reservedMemAddress) {
    WriteProcessMemory(hProcess, (void*)addr, (void*)command, sizeof(command), NULL);
    WriteProcessMemory(hProcess, (void*)addr, (void*)reservedMemAddress, sizeof(reservedMemAddress), NULL);
}
  1. How can I write the address correctly?
  2. How can I merge the two WriteProcessMemory lines into one to write the entire instruction ex:JMP 0x0048D9B2?
4
  • EA is the seg:off jump. You really want to use this one and not EB with relative offset? Also the writes seems to use the same address of the write? Dec 30, 2022 at 22:11
  • @PawełŁukasik: I want you to instruct me on the correct way to apply what I said before, injecting (ex: JMP 0x0048D9B2).
    – Lion King
    Dec 30, 2022 at 22:19
  • I think that if you look at what is written in the address addr you might understand what is wrong
    – gipi
    Jan 4, 2023 at 7:06
  • @gipi: You might see something I don't. Please clarify.
    – Lion King
    Jan 4, 2023 at 20:05

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.