Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-05-2004, 23:19
yaa
 
Posts: n/a
...when you don't have NOP instructions XDD???

I found this sentence at the very start of an old tutorial by Eternal Bliss:
"A fast tutorial with some tricks to learn how to patch P-Code when you don't have NOP instructions XDD.". The last part of the sentence says nothing to me. What does "when you don't have NOP instructions XDD" mean??? What is XDD???

yaa
Reply With Quote
  #2  
Old 09-06-2004, 00:06
void
 
Posts: n/a
Exclamation Re:What is XDD???

Hallo, It seem a strange opcode but its a smiley.

The necessary smiley trasformations are:
:-) -> :-D -> X-D -> XD -> XDD

In fact the problem is/was that the PCODE equivalent of X86 NOP opcode is/was unknown.

Search this WTK Tutorialz for NOP:
Code:
Gracias por leerme en ingles, pero hay una version en castellano XDD
On the net you can find also "P-Code Implementation by John Chamberlain"

Hope it helps,
void

Last edited by void; 09-06-2004 at 01:01.
Reply With Quote
  #3  
Old 09-06-2004, 01:42
Jay Jay is offline
VIP
 
Join Date: Feb 2002
Posts: 249
Rept. Given: 31
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 15
Thanks Rcvd at 13 Times in 5 Posts
Jay Reputation: 3
?

Quote:
In fact the problem is/was that the PCODE equivalent of X86 NOP opcode is/was unknown.
"not a lot of people know that" including me , you learn something new every day.
Reply With Quote
  #4  
Old 09-06-2004, 07:32
yaa
 
Posts: n/a
These are the links for anyone interested:

hxxp://www.woodmann.com/crackz/Tutorials/Cp375i.htm
hxxp://www.programmersheaven.com/articles/userarticles/john/vbvm.htm

and here is the article I took that sentence from:

hxxp://members.v3space.com/blackfenix/wktvbdebug/tutos/vbcrackme10.html

void, from these articles it would seem that there is indeed no equivalent for a NOP mnemonic in p-code. But then you say that it "is/was unknown". Is it still unknown???

yaa

Last edited by yaa; 09-06-2004 at 07:36.
Reply With Quote
  #5  
Old 09-06-2004, 08:44
void
 
Posts: n/a
PCODE NOP

Hallo,
I have very little experience in reversing.

In John Chamberlain's site about MS Visual basic VM there is an opcode.txt dated march 2001 which mention a P-CODE NOP equivalent FC14 while the Eternal Bliss' VBCrackMe v10.0 is dated June 1999. WKTVBDE dated 2002 assigns to FC14 the operation CI2UI1 But I found no documentation about CI2UI1.

Regarding the Eternal Bliss' VBCrackMe Tutorial if FC14 is truly the PCODE NOP, it couldn't be used to disable the 004048B7: BranchF jump (1C 07 05) in vbcrackme10.exe like the one byte X86 NOP is used to overwrite multibyte X86 opcodes.

Also the Eternal Bliss' solution to overwrite EqVarBool (which test the equality of two boolean vars and pushes -1 or 0 to the stack according to the comparision result) pushing -1 (dword) in the stack leave me a bit confused because EqVarBool takes 2 dwords from the stack and pushes one.

I don't know if the stack is freed correctly when the function returns (who manages this one more dword?).

Another way to bypass the check is to change the BranchFalse jump (1C 07 05) into an uncoditional Branch (Opcode 1E and LO HI bytes) that jumps to 004048BAh.

So
if BranchFalse(1C) 0705 is equal to BranchFalse 0x0507h and corresponds to BranchFalse 004048E3h.
then Branch 004048BAh corresponds to Branch 0x04DEh (0x0507h - (0x4048E3h - 0x4048BAh)) and is equal to Branch(1E) DE04.

This mean that 1C0705 could be changed to 1EDE04 obtaining the same result but it mess the stack too (I've just discovered that BranchF pops a dword from the stack)

How does the stack gets balanced in the virual machine?

Ok! I've read the part of by John Chamberlain's Microsoft P-Code Implementation regarding the stack:

Quote:
When a proc exits it cleans up and sets the base and stack pointers to those of the calling function and jumps to the return pointer stored above the base pointer. There is no simple "ret" as in a normal function call. The engine does it manually. When a proc returns it just continues on in whatever handler called it.
But if I correctly understand the example in
Microsoft P-Code Technology


Code:
Source code   P-code   
m = i+j+func(); L1: LdfW i 
    LdfW j 
    AddW   
    CallFCW func 
    AddW   
    EQuote   
    StfW m 
n = i + j + func();   Quote L1 
    StfW n
a function return its value in the stack context of the calling function. In these case I suppose the stack is balanced by the VM,too.

Regarding the PCODE NOP, I don't know if there is a VBVM opcode of the DoNothing VB statement neither a X86 NOP equivalent.
Is there an updated and detailed VB opcode List with mention of values pushed onto the stack?

I edited this post many time as I discovered new infos I did not post new replies to prevent the "Posting of Substance" Feature .

I hope I've not caused any confusion.

void

Last edited by void; 09-06-2004 at 18:47.
Reply With Quote
  #6  
Old 09-07-2004, 03:45
yaa
 
Posts: n/a
For those interested, for p-code VB apps good tools are ExDec (hxxp://www.iespana.es/jbduc/downloads/tools/betaexdec.zip), VBParser (hxxp://www.pediy.com/tools/Decompilers/VB_pcode/VBParser/VBParser1.2.zip) and WKTVBDebugger (hxxp://vbdebug.cjb.net/). Smartcheck instead is good for non p-code apps.


yaa
Reply With Quote
  #7  
Old 09-08-2004, 23:43
Sarge
 
Posts: n/a
CI2UI1

CI2UI1 =
Convert Integer_2_Byte to Unsigned_Integer_1_Byte

Function should be evident from above text.


As for NOP, also check for some minor info:

hxxp://www.woodmann.net/forum/showthread.php?t=5628&highlight=NOP

Thanks
Sarge
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
crackme with FILD, FLD, FSTP instructions Zeocrack General Discussion 1 11-05-2022 20:09


All times are GMT +8. The time now is 08:09.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )