View Single Post
  #3  
Old 06-30-2004, 03:00
acidx
 
Posts: n/a
that wouldn't do me any good, i'm trying to write a program in c++ that can scan executables(same one just different versions) for the location of a call to an imported function from kernel32 and then patch the jump instruction following the compare instruction thats right after the call to the imported function.

Heres an example:

Call [00605AC0] - FindWindowA
cmp eax, ebx
je 0047e8c4

Now lets say FindWindowA was only in one part of the program but over different revisions this position changed offset wise but the overall assembled code was always the same. I want to be able to scan the file for this one call to FindWindowA and then patch the je instruction to a jmp instruction. This isn't the exact api call or section of code i want to change its just an example so you can better understand what i mean a little better.
Reply With Quote