pRINCESS
NOP conditional JMP
Thu Dec 17 20:57:43 1998


Solution Task #3


Conditional jump require to be NOPed is the JNE offset :0043FA09


* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043F958(C)
|………………….
0043F9EE 8B45FC mov eax, dword ptr [ebp-04]
:0043F9F1 50 push eax
:0043F9F2 8D55F8 lea edx, dword ptr [ebp-08]
:0043F9F5 8B83F8010000 mov eax, dword ptr [ebx+000001F8]
:0043F9FB E8B4D6FDFF call 0041D0B4 ß--------------------------- This call calculates our
serial #
:0043FA00 8B55F8 mov edx, dword ptr [ebp-08] ß------------------ Our Serial #
:0043FA03 58 pop eax
:0043FA04 E8FB41FCFF call 00403C04
:0043FA09 752E jne 0043FA39 ß-------------------------------------- Jump if NOP ed will allow
any number or name combination
:0043FA0B A1209B4400 mov eax, dword ptr [00449B20]
:0043FA10 8B00 mov eax, dword ptr [eax]
:0043FA12 E8D5AFFEFF call 0042A9EC
:0043FA17 A1109D4400 mov eax, dword ptr [00449D10]
:0043FA1C 803800 cmp byte ptr [eax], 00
:0043FA1F 750C jne 0043FA2D
:0043FA21 A1089D4400 mov eax, dword ptr [00449D08]
:0043FA26 8B00 mov eax, dword ptr [eax]
:0043FA28 E863ADFEFF call 0042A790


Princess