3

je is normally used with cmp instruction like cmp Reg16/32/64,const je someplace while jz is normally used to check specifically for 0 or null like dec reg16/32/64 jz someplace i just modified your code to an infinite loop and emulated it in x86 emulator see below for code and gif. code mov ax, 0x2 dec ax and ax, 0x1 jz equal je equal test ax,...


2

You are referring to the early 80s of the last century. The 8086 architecture used this way of addressing 20-bit physical memory, the then tremendous amount of 1 (One!) MByte, or "one million bytes of memory", as Intel calls it in /1/, p.2-7. These "logical addresses", as Intel called them in /1/, served primarily two purposes: One idea ...


2

The connect syscall takes a sockaddr structure as an argument, which looks something like this: struct sockaddr_in { short sin_family; u_short sin_port; struct in_addr sin_addr; char sin_zero[8]; }; They aren't extracting 4444, it's simply passed on the stack as a two-byte short. You are passing to connect, in little-...


1

I have no experience in writing a DLL, but what I understand is that I should be able to compile functions inside the DLL then somehow call them from the executable, and my hope would be that I don't need to modify the executable itself. Can someone confirm this? This is correct. Check out https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain, common ...


1

josh's answer is a good one, but one thing to note is that there is an alternative scheme that (usually) does not require inline assembly, and which handles the virtual functions case also. This is how I prefer to interact with C++ programs when I'm doing DLL injection/code reuse like your question is asking. Begin by defining something for the class whose ...


1

This is an interesting problem where some issues have to be solved. For the first part of your question: How to run an exe from memory, you might want to consult the following link: https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer In the following, I will try to show you how to tackle your second question, how to call a class ...


1

They aren't any, do no try to do the mathematically impossible. For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, I wonder if there are stronger ones. Yes, because there is no way of detecting a debugger that can not be faked. Software can not detect if it runs in a ...


Only top voted, non community-wiki answers of a minimum length are eligible