Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 08-26-2008, 04:40 AM
hexman hexman is offline
Member
 
Join Date: Aug 2008
Posts: 13
Default wlscgen

how to change memory address [00574199] to new value 0x43000001 in wlscgen in olldbg
hexman
Reply With Quote
  #2  
Old 08-28-2008, 12:32 AM
hexman hexman is offline
Member
 
Join Date: Aug 2008
Posts: 13
Default replay

no help from anyone???
Reply With Quote
  #3  
Old 08-28-2008, 08:42 AM
BfoX BfoX is offline
Senior Member
 
Join Date: Aug 2007
Posts: 2,040
Send a message via ICQ to BfoX Send a message via MSN to BfoX Send a message via Yahoo to BfoX
Default

explain your problem
what you want, etc.
__________________
... Either you work well or you work much ....
Reply With Quote
  #4  
Old 08-28-2008, 11:21 AM
kodyazan kodyazan is offline
Senior Member
 
Join Date: Jul 2008
Posts: 60
Default

Quote:
Originally Posted by hexman View Post
how to change memory address [00574199] to new value 0x43000001 in wlscgen in olldbg
hexman
Press Ctrl+E.
Reply With Quote
  #5  
Old 08-29-2008, 02:01 AM
kodyazan kodyazan is offline
Senior Member
 
Join Date: Jul 2008
Posts: 60
Default

Quote:
Originally Posted by hexman View Post
i dont see [00574199] (memory address) in olldgb and w32dsm. but i can see in IDA and how to change this value. here??
hexman

1-Be sure that you are looking at same modules.

2-Search the OPCODE. Not the address.

Open IDA.Click on the address you see. Look at the Hex View-A tab. Write down the corresponding OPCODE which is highlightened.

Open OllyDbg. Search (as binary string) the opcode you found above.

Example (I assume you want to find 00401089 or 004010d3 in Olly.)

IDA:
00401089 jz loc_4010D3 (Click the Hex View-A tab, you see 0f8444000000)

In OllyDgb, you search for opcode (0f8444000000) not the address (004010D3). And you see

OllyDbg:
00401089: 0f84 44000000 --> JE 004010D3

Last edited by kodyazan : 08-29-2008 at 02:07 AM.
Reply With Quote
  #6  
Old 08-29-2008, 05:19 AM
hexman hexman is offline
Member
 
Join Date: Aug 2008
Posts: 13
Default thanks for help

how to change here
http://img80.imageshack.us/img80/9333/574199fs1.jpg
hexman
Reply With Quote
  #7  
Old 08-29-2008, 12:43 PM
kodyazan kodyazan is offline
Senior Member
 
Join Date: Jul 2008
Posts: 60
Default

Open hview.

press F4,select hex
press F7 search for 43000000(hex)
press F3 (edit)
Write new value.
press F9 (Save exe)
Reply With Quote
  #8  
Old 08-29-2008, 11:38 PM
hexman hexman is offline
Member
 
Join Date: Aug 2008
Posts: 13
Default thanks

I am not able to edit. How to do it in IDA pro 5.2??
HM
Reply With Quote
  #9  
Old 08-30-2008, 09:58 PM
soybean soybean is offline
Member
 
Join Date: Feb 2007
Posts: 16
Default

Does anyone have WLSCGEN ver.8?
Reply With Quote
  #10  
Old 09-01-2008, 01:39 AM
hexman hexman is offline
Member
 
Join Date: Aug 2008
Posts: 13
Default help

why i see 574199 memory as 43000000h ?? not as 43000000
HM
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.