3
to search String you cant be using disassemble-all
look at the bytes in both commands if you disassemble how can you find the string
objdump -s sample.exe |grep -i sample
sample.exe: file format pei-i386
404040 00000000 53616d70 6c652100 20634000 ....Sample!. c@.
objdump -M intel --disassemble-all sample.exe --start-address=0x404044 --stop-address=...
2
Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original.
For example, at offset 0x58, there's supposed to be push edx so the byte should be 0x52, but you have push esp which is 0x54. Since the article mentions that this part is encrypted with a xor (with a single ...
1
Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable.
In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine.
If debugging a ...
Only top voted, non community-wiki answers of a minimum length are eligible
