2

I want to reserve space for my codecave in application. I use VirtualAlloc function to reserve this space. I have X questions.

  1. What parameters (sllocation type and protection) should I use to allocate memory for code-cave?

  2. As return value I get address of my codecave. In other part of the program I want to JMP to that codecave. How to do it? I know (correct me if I'm wrong) that JMP takes as agument nuber that is offset from current location. But I want to JMP to ma codecave. How to calculate this offset.

enter image description here

Hooch
  • 28,817
  • 29
  • 102
  • 161
  • 1
    possible duplicate of [C# Theoretical: Write a JMP to a codecave in asm](http://stackoverflow.com/questions/787006/c-theoretical-write-a-jmp-to-a-codecave-in-asm) – Jim Brissom Mar 09 '11 at 07:48

3 Answers3

6

Just stumbled across. To clearify this topic for the rest of us: Calculating the relative JMP offset to a codecave patch works by subtracting your patch address with your current programm counter address:

uint32_t patch_address = (uint32_t) VirtualAlloc(...);
uint32_t jmp_offset = patch_address - (current_offset + current_len);

Note: current_len is the number of bytes your JMP instruction takes. This depends on the fact if its a short jmp (EB) or a long jump (E9). In your example 2 bytes, but a regular JMP (E8 0x12345678) takes 5 bytes.

So here we see that your example wont work easily, because you would have to override the next bytes that belong to the following MOV and even the CALL instruction(s). This relies on the fact that your codecave has a greater distance to the current instruction offset because it is allocated in a different region in the address space.

So what you can do is to copy the overwritten 7 Bytes into your cave. That can only work if you dont mess with EDI register in your patch (because of the "MOV ECX, EDI"). And you would have to correct the CALLs address you are overwriting. So this is probably not the best location to place a codecave, but its doable.

i wrote my own hooking library that cares for generic register arguments, stack cleanup and overwritten asm paddings, but i suggest to use the above mentioned frameworks.

regards, michael

mschmoock
  • 20,084
  • 6
  • 33
  • 35
2

Subtracting the address of your jump target from the address of the instruction after the jump will give you the jump offset.

Gunther Piez
  • 29,760
  • 6
  • 71
  • 103
0

If you don't get such things, use a library like MS Detours, N-CodeHook, or something else.

Abyx
  • 12,345
  • 5
  • 44
  • 76
  • 1
    I only want to know how to calculate that JMP offset if I know loacaion of my ocde cave. – Hooch Mar 09 '11 at 08:21