Stack... a double Dutch.

[hell0]

[deleted]

[PBrennick]

Because ESP is actually referencing a memory location so ESP is a pointer to a memory address and the contents of that address is the value popped.

Paul

[hell0]

[deleted]

[hell0]

[deleted]

[BlackVortex]

Delta offset trick, checking for the MZ signature ...   :boohoo:

Hmmm, creating a virus are we ? I see no future for this thread.

But in an asm-related answer : when you have 00400xxx and perform an OR against 0FFFh and then a XOR against 0FFFh, you get 400000. It's a way to round it down to a 1000 boundary. You can use 0FFFFh to round it to a 10000 boundary.

[qWord]

Delta offset trick

never saw such an tricky way for calculating zero :bg

[PBrennick]

I, also, am concerned about this thread and its goals. What exactly are you trying to do? Are you searching memory for executables? Looks that way to me.

Paul

[hell0]

[deleted]

[sinsi]

It sounds like someone is disassembling something and can't get it  :bdg
To be fair, a lot of programs check the MZ and header (C++ or .net?) - I'm talking about commercial (and MS windows) programs.

Delta offset trick, checking for the MZ signature ...   :boohoo:

heh

[BlackVortex]

Delta offset trick

never saw such an tricky way for calculating zero :bg

Ehehe ... it only returns 0 if it's ran on 400000. If the code is relocated, then it returns the delta difference, which you're supposed to add to all offsets. So that the code works the same, no matter on which offset it's relocated.

@ hell0
One of the Iczelion tutorials explain a nice way to check the validity of an executable file. Check them out, it's one of the first few tutorials. I remember he also sets an exception handler to avoid screwups while reading.

[hutch--]

 :tdown

> for enlightening a hazy part of my understanding...

It will get a lot hazier a lot faster if I even hear the word virus or anything that even vaguely sniffs of it.

[hell0]

A hypothetical caution that weaken the very spirit of research.

regards...

[hutch--]

 :bg

Another one bites the dust.  :P

[hutch--]

Sorry qWord but I chucked this guy out for a reason, I don't want his type of interests supported here.