View Single Post
Old 29 December 2018, 17:28   #30
tlenl
Registered User
 
Join Date: Dec 2018
Location: Italy
Posts: 19
WTF Toni, after reading a quick ASM tutorial (NEO: "I know kung fu.") i've understood everything you're talking about!

You include in your fingerprint everything is absolute and fixed (D and A registry and constants #) and mask everything variable (memory addresses).

In your case the first number 5378 identify the SUB to patch.

We could extend the concept making a variable FINGERPRINT and an offset identifying the number position to patch in case of particularly difficult code block to make unique. Like:

FINGERPRINT(<FINGERPRINT LENGTH IN WORDS>,<START OFFSET POSITION IN WORDS>,<FINGERPRINT STRING>)

So in gods case

FINGERPRINT(14,0,'5378xxxx6a00feca4eb9xxxxxxxx3f003f01323c0064303c002a4eb9')

If for example we would have to go "before the instruction" we would have

002a4eb9xxxxxxxx5378xxxx6a00feca4eb9xxxxxxxx3f003f01323c0064303c

and so

FINGERPRINT(14,5,'002a4eb9xxxxxxxx5378xxxx6a00feca4eb9xxxxxxxx3f003f01323c0064303c')

What do you think about?

EDIT:

Back to square one, the offset would identify the VARIABLE to patch not the FUNCTION

so it would be written in the plugin


FINGERPRINT(14,6,'002a4eb9xxxxxxxx5378xxxx6a00feca4eb9xxxxxxxx3f003f01323c0064303c')

FREEZE(FINGERPRINT)

or

FINGERPRINT(14,1,'5378xxxx6a00feca4eb9xxxxxxxx3f003f01323c0064303c002a4eb9')

FREEZE(FINGERPRINT)

Last edited by tlenl; 29 December 2018 at 18:17.
tlenl is offline  
 
Page generated in 0.06666 seconds with 11 queries