Answer the question
In order to leave comments, you need to log in
How to find out where the code will be located in EXE memory?
Good afternoon.
I'm making a patch for an EXE file.
I found the necessary place in the EXE file at offset O1.
The new code has a command:
CPU Disasm
Address Hex dump Command Comments
008058D1 D80D F24C8000 FMUL DWORD PTR DS:[804CF2] ; FLOAT 4472.420
CPU Disasm
Address Hex dump Command Comments
008058F0 /EB 08 JMP SHORT 008058FA
008058F2 |0000 ADD BYTE PTR DS:[EAX],AL
008058F4 |C8 4290 90 ENTER 9042,90
008058F8 |90 NOP
008058F9 |90 NOP
008058FA \90 NOP
Answer the question
In order to leave comments, you need to log in
In general, it is not clear what exactly you want to get from what. Do you have some "address" - 0x804CF2 and want to find the offset in this EXE file that corresponds to this address?
He said the evil hackers have already done everything for you. PE Tools utility, select process, select executable file, RMB, PE editor -> read only, FLC(File Location Calculator), RVA, VA, file offset, consider anything from anything. It makes no sense to do the calculation in the patcher, if this is not the same executable file that you have, then you will simply break it with your RVA to FO. Just write the hash of the file and the offset in the file to the patcher source. By the way, it was easier to google the function code with a simple rva to file offset
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question