将绝对 JMP/CALL 组装到相对 JMP/CALL 工具/插件？
我有这个程序，我正在尝试对其进行逆向工程。我不知道是否是编译器的优化器或混淆，但现在调用其他函数的代码的某些部分是通过数学计算然后调用的，直到
CALL EAX
它作为DLL加载到另一个程序中时才能正常工作。基地址偏移量已更改，因此现在所有相关代码都可以正常工作，但所有数学计算的调用/jmp 都不会进入正确的区域。
所以我想我可以通过将所有绝对调用转换为相对调用来轻松解决这个问题。
在单步执行代码并计算所有数学运算时，我得到了正确的 jmp/call 偏移量。
我没有遇到诸如没有足够的空间来分配补丁之类的问题。由于绝对调用通常使用之前的行，我也可以使用它来修复
绝对调用，这就是数学结束的地方：
seg000:0044F7D1 add eax, 3B882683h
seg000:0044F7D6 call eax
转换为类似
seg000:0044F7D1 call 3B882683h
上面的当然行不通，因为 eax 已经是东西了，但是这只是一个伪代码示例
，我的问题不是如何执行此操作，而是有没有任何插件可以在 OllyDbg 或 IDA Pro 中自动为我执行此操作？
I have this program I'm trying to reverse engineer. I don't know whether or not it was the compiler's optimizer or obfuscation, but now some parts of the code that call other functions are calculated by math then called such as
CALL EAX
It works properly until it's loaded as a DLL in another program. The base address offsets are changed so now all relative code works properly, but all the math calculated calls/jmps don't go to the proper areas.
So I figured i'd fix this easily by making all absolute calls into relative calls.
While stepping the code and letting all the math get calculated I get the correct jmp/call offset.
I am not having problems like not enough space to allocate the patch. Since the absolute call is usually using the line before which I could use as well to fix things up
Absolute call, this is where the math ends:
seg000:0044F7D1 add eax, 3B882683h
seg000:0044F7D6 call eax
to be converted to like
seg000:0044F7D1 call 3B882683h
Well the above of course will not work as eax was already something, but it's just a pseudo code example
Well my question is not how to do this, but is there any plugin that automatically does this for me in OllyDbg or IDA Pro?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你可以使用LoadLibrary
同样，当您导入标头时，所有函数地址都会保存到稳定地址。函数的地址是变化的，但你总是称这些稳定的地址而不是函数的地址。
您可以通过“pe explorer”等程序查看dll函数的地址。
你总是调用 00402008h ，但 00402008h 不是你的函数的地址。
00402008 的值是您的函数的地址。
you can use LoadLibrary
also when you import a header all functions addresses are save to the stable addresses. address of functions are changes but you always call these stable addresses not address of your functions.
you can see address of dll functions by some program like "pe explorer".
you always call 00402008h ,but 00402008h is not address of your function.
value of 00402008 is address of your function.
你想获得变量调用的计算地址，这真的很难弄清楚，因为它们不相等，你如何在这部分中解释它
seg000:0044F7D1 add eax, 3B882683h
seg000:0044F7D6 call eax
制作这样一个插件确实很容易，但它从来都不是那样的。 EAX 可能会在该部分代码中发生更改，这就是调用是“变量”的原因。试想一下，游戏中的一部分代码控制着一扇门或其他什么，如果不允许你通过EAX或任何其他寄存器，则会更改为调用该函数不让你通过，否则你可以通过，因为你有钥匙或类似的东西，代码会将 EAX 更改为调用执行代码以开门的地址。这只是一个例子，因为存在带有变量的调用。您想到的插件必须监听所有可能的调用，这些调用可能非常庞大，并且会导致错误或无法概览。
所以对你来说最简单的方法是中断直到这个调用并读取寄存器。
我希望这可以帮助您理解，否则我没有回答正确的问题，您的问题有点误导，因为您所说的有关 JMP 和 dll 注入的内容让我很恼火。更详细的可以私信或者这里告诉我。
you want to get the calculated adress of the variable calls, thats really hard to figure out because they are not equal, how you explained it in this part
seg000:0044F7D1 add eax, 3B882683h
seg000:0044F7D6 call eax
would be realy easy to make such an plugin, but its never just like that. The EAX could change in that part of code thats why the call is an "variable". Just imagine, a part of code controlls a door in a game or whatever, if you are not allowed to pass EAX or any other register would change to call the function to dont let you pass, otherwise you are allowed because you have a key or something like that and the code will change EAX to the adress that the call executes code to open the door. That was just an example because there are calls with variables. A Plugin that you think about, must listen all there possible calls that can be a really gigantic mass and would cause to bugs or no overview.
So the easiest way for you is to break untill this call and read the register.
I hope that can help you to understand or I did not answered the right, your question is a little bit misleading because you said things about JMPs and a dll inject that irritates me. You can tell it me more detailed in a private message or here.