Multi unconditional jumps

Question

1.00/5 (1 vote)

See more:

Hey

I am coding a simple packer. I need help

How do i implement Multi-Branches tech? for example

401000:
mov eax,10
jmp 401023

401010:
sub ecx,ecx
JMP 401040

401023:
xor edx,1
add ebx,4
jmp 401010

401040:

etc...

I want to implement this on random order. Is there any documentation on how this can be done?

actually my idea is to fill a section with unique DWORD then search for this if found then it will jump to and write codes then search again and so on. But this is not efficient.

Any other ways?

Posted 18-Jun-13 3:08am

NoviceCoder87

Updated 18-Jun-13 4:55am

JackDingler

v5

Add a Solution

Comments

Sergey Alexandrovich Kryukov 18-Jun-13 9:52am

Not clear. Your code will just jump infinitely. If you need help, you should explain the behavior you need precisely. No documentation can help here: all you need you already have.
—SA

NoviceCoder87 18-Jun-13 13:55pm

What you mean not clear? i meant same tech used by Themida VM and VMProtect. lot's of jumps here and there. I can easily add forward branch but my problem is backward branch which if i choose randomly it can get inside a used code already. So to be more clear i choose random destination to jump to, add jmp then update code pointer to that destination so at that location continue code.

Sergey Alexandrovich Kryukov 18-Jun-13 16:12pm

Sorry, still not clear. What, don't you know what it means? I don't event understand what do you mean by "random", there are some different meanings of this word.

And sorry, I have no idea who is Themida. ASM jumps are way too simple, there is nothing to read about except the reference book.

—SA

CHill60 22-Jun-13 10:08am

I suspect that the Themida protection tools don't randomly overwrite existing code that is being executed. Part of the confusion we have is not being able to understand why you would want to do this or exactly what you are trying to achieve. Incidentally the word is "technique" not "tech"

NoviceCoder87 22-Jun-13 12:20pm

Probably as you think. What i am trying to achieve is multiple unconditional branches. Not directly written in source code. But in the loader that will load the EXE file. It is a part of protection. But i am not sure how to do it.

Christianirwan 10-Aug-13 4:06am

What do you think is actually not random jumps. There are decoy to not read assemblies, the way is that. It actually can be written:

mov eax, 10 // replace eax, by 10
xor edx, 1 // Toggle the last byte.
add ebx, 4 // Add ebx by 4
sub ecx, ecx, // zero the ecx

Christianirwan 10-Aug-13 4:06am

What do you think is actually not random jumps. There are decoy to not read assemblies, the way is that. It actually can be written:

mov eax, 10 // replace eax, by 10
xor edx, 1 // Toggle the last byte.
add ebx, 4 // Add ebx by 4
sub ecx, ecx, // zero the ecx

Christianirwan 10-Aug-13 4:06am

What do you think is actually not random jumps. There are decoy to not read assemblies, the way is that. It actually can be written:

mov eax, 10 // replace eax, by 10
xor edx, 1 // Toggle the last byte.
add ebx, 4 // Add ebx by 4
sub ecx, ecx, // zero the ecx

Christianirwan 10-Aug-13 4:06am

What do you think is actually not random jumps. There are decoy to not read assemblies, the way is that. It actually can be written:

mov eax, 10 // replace eax, by 10
xor edx, 1 // Toggle the last byte.
add ebx, 4 // Add ebx by 4
sub ecx, ecx, // zero the ecx

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)