Template:Asm:LoadPtrsFromDissectToRegisters

Load Pointers From Dissect Data / Structures

sometimes you find valid compare points under pointers, but how to use pointers from dissect data / structures?.

[enable]


aobscan(symbol,01 23 45 67 89 AB CD EF)

alloc(newmem,$1000)

registersymbol(symbol)




label(originalcode)

label(exit)




newmem:

push eax

mov eax,[ebx+54]

cmp byte ptr [eax+10],01

pop eax

jz exit




originalcode:

mov [ebx+04],eax

jmp exit




symbol:

jmp newmem

nop




exit:


[disable]


dealloc(newmem)


symbol:

mov [ebx+04],eax


unregistersymbol(symbol)