Lets assume I've allocated the address where my codecave is placed using VirtualAllocEx
(it returns the address) and I write my code into that address using WriteProcessMemory()
.
Here's the question:
How do I write a jump to my codecave? I know that jumps start with "E9
", but how do I convert the address returned by VirtualAllocEx
into a correct UInt32 (dword) so the debugger/compiler will understand the instruction?
For example:
I'm at address 00402020
(OEP of the native app). I write a jump to 004028CF
(empty place) "JMP 004028CF
". The instruction in bytes looks like this:
CPU Disasm
Address Hex dump Command Comments
00402020 E9 AA080000 JMP 004028CF
"E9
" is how we indicate a JMP. What about "AA080000
", how do I generate this?
I need to do something similar so I can initialize a JMP to my codecave, which will be located at an address returned by VirtualAllocEx()
.
Any help will be gratefully appreciated!
Thanks in advance.