Could anyone tell me how to check if an address is nopped?
I want it if it's nopped to show a msg box saying "nopped!" and if it isn't nopped i want it to say "not nopped."
Printable View
Could anyone tell me how to check if an address is nopped?
I want it if it's nopped to show a msg box saying "nopped!" and if it isn't nopped i want it to say "not nopped."
Do you mean NULL, or are you talking about the nop asm instruction?
NOP ASM instruction
Well an address being nop'ed does not make sense. NOP is an asm instruction and outside of that context it's hexadecimal equivalent could appear anywhere. But it only means NOP in the context of a program.
Ehm, what are you ACTUALLY trying to do?
The opcode for NOP is 0x90 [I'm a rather sad geek, as I knew that without even looking it up], so checking if the address to see if it's 0x90 at that address will tell you if it MAY be a NOP or not.
To properly know for sure, you'll need to know where the piece of code you're looking at starts, and then parse through each of the instructions until you get to the point you're looking at. Consider something like this:
That will contain something like:Code:int some_func(int x) {
return x | 0x90;
}
That code will contain 90 00 00 00 as a constant.Code:...
or 90h, eax
...
Note also that at least AMD recommends using "other" instructions as NOP's when needing long NOP sequences (for aligning to 16-byte boundary for example), you could use things like "mov esi, esi", "lea [esi], esi", "lea [esi+0],esi" or a bunch of similar things [and not necessarily with ESI of course] - these are ALSO "NO-OPERATIONS", but of course not NOP. Another variant is to add a 0x66 prefix to the 0x90 opcode - that tells the processor to switch between 16- and 32-bit operands for this particular instruction, which is still a "NOP", but it takes up two bytes.
--
Mats
Do you mean, you want to find out if your program has NOP's?
The easiest way would be to enable compiler warnings. It should tell you when a statement has no effect.
But that's not to say that the code generated by the compiler contains a NOP instruction - it just means that you did something like:Quote:
Originally Posted by anon
;Code:int j;
...
j;
--
Mats
Quote:
Originally Posted by anon
Well i'm trying to make an anti-hack dll for a game, and hacks nop adresses to activate there hacks (i know what adresses they will NOP), so i wanna check of there nop'ed and if they are i will terminate the adresses, but i use msgboxes for testing.
A complex checksum of the game would probably be a better idea - something like a CRC32 or MD5sum, so that if you change one bit in one place, the checksum is different. Do this over the entire code-base and you'd be OK. Run this periodically over the code, and you should be OK.
There's absolutely no reason why a game-hacker couldn't change the code in other places than where the NOP's are either - it's quite possible to add a "jump" in exisiting code and then replacing the existing code where the jump lands.
--
Mats
And what's to stop me from NOPping out the code which checks the NOPs?Quote:
Originally Posted by brietje698
And how would this be done? ^^Quote:
Originally Posted by matsp
You mean, how would one use a checksum?
Or how would one add code to jump around like that?
> Well i'm trying to make an anti-hack dll for a game
Think of your anti-hack as a game in itself.
1. You get to write all the rules.
2. You only have a finite amount of time to implement the rules.
3. You only get to play the game once.
4. You are alone.
I mean, once you've released your s/w, the game is up as far as you're concerned. You've played your hand, and everyone can see your cards.
The opposition on the other hand are
1. Have potentially an infinite amount of time.
2. Can play as many times as they want.
3. Large in number.
What's the betting that you're going to win?
This being the internet and all, as soon as someone knows how to beat you, it doesn't take more than a few minutes before everyone else does as well.
If you mean "how do you replace an existing bit of code with a jump that does the overwritten code wher the jump lands", then it's pretty simple - of course, you DO need to find a space to store the code you jump to.Quote:
Originally Posted by brietje698
There are several ways to find some place for the code:
- allocate some more memory with execute privileges by the Win32 API -
- by replacing some "Unused code", e.g. some error handling code that only happens when the application does something unusual, like running out of memory or dividing by zero or some such that doesn't happen under normal operaiton - there's usually "unused" code in any application -
- if nothing else, overwriting the "exit-code" that leaves the application is always an option - it may not be able to exit nicely any longer, but who cares...
No, I haven't done exactly this sort of hacking, but I have replaced code in executables/binaries for professional reasons at work - and there's USUALLY some place to put the code even in a fixed size binary.
So, once we've found a target code and some place to put our "extra" code, we do:
- insert a "jmp my_code" in place of some other instruction(s).
- add those "other instructions" at the beginning or end of "my_code",
- my code also does whatever it is that I wanted to do that wasn't in the original code, say increase my points in the game by 100 every time the letter K is pressed, or add more lifes to my player when I press "&", etc, etc.
- jump back to just after the "jmp my_code", making sure this is a valid instruction.
--
Mats
The prefix is not a NOP.Quote:
Another variant is to add a 0x66 prefix to the 0x90 opcode - that tells the processor to switch between 16- and 32-bit operands for this particular instruction, which is still a "NOP", but it takes up two bytes.
I have a very hard time believing NOPs are used for inserting hacks into games. There are much more elegant ways that do not mess with the core source code being ran. However as the discussion of these methods most certainly does not fall within the guidelines of this forum I will not discuss them.
But all this sounds very suspect right from the word "go".
I ment making the checksum from the codebase..Quote:
Originally Posted by matsp
I think it's quite feasible to overwrite NOPs in code to insert other code, but there are certainly plenty of other methods for subverting code in an application. Overwriting parts of it with NOP's would be another possibility.Quote:
Originally Posted by Bubba
0x66 is a prefix in x86, which toggles 16/32-bit registers.
The two bytes of 0x66 0x90 is a NOP (exactly, it is "xchg ax, ax" in 32-bit, and "xchg eax,eax" if you execute in 16-bit mode - but since xchg doesn't actually do "anything" when both sides are the same register, it's a "NOP", and someone at Intel in the late 70's/early 80's decided that "NOP" should be the opcode of "xchg ax,ax". Multiple 0x66 prefix are also supported by the processor, as long as the total number of bytes is less than 15.
I agree, there's many other ways you could manipulate what the code in a game does, without inserting or removing NOP instructions.
--
Mats