Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/idouble/simple-disassembly-notes
⚙️ Simple Step to Step Tutorials for Disassembling / Code Injection & getting Pointer Addresses 🔧
https://github.com/idouble/simple-disassembly-notes
assembly code code-injection codeinjection collection disassembler disassembly disassembly-notes memory offsets pointer pointer-address process read reverse-engineering simple step-tutorials tutorial tutorials write
Last synced: 14 days ago
JSON representation
⚙️ Simple Step to Step Tutorials for Disassembling / Code Injection & getting Pointer Addresses 🔧
- Host: GitHub
- URL: https://github.com/idouble/simple-disassembly-notes
- Owner: IDouble
- License: mit
- Created: 2019-08-09T06:55:35.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2024-02-29T16:55:09.000Z (8 months ago)
- Last Synced: 2024-10-04T12:53:12.312Z (about 1 month ago)
- Topics: assembly, code, code-injection, codeinjection, collection, disassembler, disassembly, disassembly-notes, memory, offsets, pointer, pointer-address, process, read, reverse-engineering, simple, step-tutorials, tutorial, tutorials, write
- Language: Assembly
- Homepage:
- Size: 1.37 MB
- Stars: 29
- Watchers: 3
- Forks: 4
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# ⚙️ Simple Disassembly Notes 🔧
⚙️ Simple Step to Step Tutorials for Disassembling / Code Injection & getting Pointer Addresses 🔧
## 🔧 Get Pointer Address from Value 🔧
1. Set Value Type **All**
2. Set Value (ex. (Int 32 = 4 Byte = 32 Bit) 85 or (float/double) 85.5) you search for and press **First Scan**
3. Change Value in the Process
4. The Changed Value will be red, on the left is the **Pointer Address**
## 🔧 Replace the Assembly Code with Code that does Nothing 🔧
1. Right Click on Address Record
2. Select **Find out what writes to this address**
3. Press on **Replace**
4. **Delete the Assembly Code** and Press **OK**
## 🔍 Get the Pointer Address from the Pointer of the Value (Way 1 : easier) (level-1 pointer) 🔍
1. Read the Address
2. **Check Checkbox Hex** and put the Address in it
3. The **Address** to the Pointer is in this ex. 1002CBA40
## 🔍 Get the Pointer Address from the Pointer of the Value (Way 2 : harder) (level-1 pointer) 🔍
1. Select **Find out what writes to this address**
2. Press on **More information**
3. The **Address** to the Pointer is in this ex. 011DC7A0
## 🔍 Get the base Address from a multilevel pointer (level-4 pointer) 🔍
### ➡️ Example of a level-4 pointer ➡️
*01168A78* = Address / base pointer (base ptr)
**0x18** = Offset
***"Tutorial-x86_64.exe" + 2CBA70*** = static base address
-> = points to
*01168A78* = Value = 2765
*01188070* -> *1168A60* + **0x18** = *01168A78*
*01168A18* -> *01188070* + **0** = *01188070*
*011681D0* -> *1168A00* + **0x18** = *01168A18*
***"Tutorial-x86_64.exe" + 2CBA70*** -> *11681C0* + **0x10** = *011681D0*
### 🔍 How to find out each base pointer with its offsets until you get to the static base address 🔍
1. Right Click on Address Record
2. Select **Find out what accesses this address**
3. Calculate the Address using the Offset ex. -> (***01188070*** -> **1168A60** + 0x18 = 01168A78)
Calculation (hex) : (01168A78 - 18 = 01168A60 = **1168A60**)
4. **Check Checkbox Hex** and put the Address in it (ex. **1168A60**)
5. The **Address** to the Pointer is in this ex. ***01188070***
6. **Repeat Step 1 to 5** until you get the static base Address, in this ex. ***"Tutorial-x86_64.exe" + 2CBA70***
## ⚙️ Add Pointer Address manually (level-1 pointer) ⚙️
1. Click on **Add Address Manually**
2. Add Address, if needed with Offsets and click **OK**
3. The Result should look like this:
## ⚙️ Add Pointer Address manually (level-4 pointer) ⚙️
1. Click on **Add Address Manually**
2. Add Address, if needed with Offsets and click **OK**
3. The Result should look like this:
## 🛠 Code Injection 🛠
1. Right Click on Address Record
2. Select **Find out what writes to this address**
3. Press **Show disassembler**
4. Click on **Tools** and select **Auto Assemble**
5. Click on **Template** and select **Code Injection**
6. Click on **OK**
7. **Comment out** as an ex. //sub dword ptr [rsi+00000780],01 (value - 1)
8. **Write** as an ex. add dword ptr [rsi+00000780],01 (value + 1)
9. Press on **Execute** and then click OK and it's Done!
