0

I'm new to reverse engineering and i'm trying to change a

__text:001C2BE4                 jz      loc_1C3180

which jumps to 

__text:001C3180 loc_1C3180:

into a jump to another subroutine. (__text:00128DC0 sub_128DC0:)

However, I don't yet understand how to do this. I can change assembly by editing the hex values but as loc_* is just a name given to the subroutine by IDA I don't know how to do this.

Could someone explain how to go about changing the destination of a jz?

Thanks.

Laurent
  • 1,292
  • 4
  • 23
  • 47

1 Answers1

2

As it turns out, loc_1C3180 is not just a name given to the subroutine by IDA - it is in fact derived directly from the (image-relative) address of the loc-ation being jumped to, which in this case is 0x1C3180.

jz is followed by an (in this case) 32-bit signed offset, which is added to the instruction pointer, if the condition is met.

The signed offset to use can be calculated with the following formula (note: may wrap around)

JumpOffset = Address of jump target - (Address of Jump instruction + 5)

The +5 comes in because that's the length of the jz instruction including the offset.

500 - Internal Server Error
  • 28,327
  • 8
  • 59
  • 66