Converting Assembler Byte Instruction to String

0

I have instructions which are like this

pokeEnableMap = new byte[6]{
        233,
        0,
        0,
        0,
        0,
        144};

and I'd like them like this:

pokeEnable = @"call 0x{0:X}
        nop
        nop
        nop";

or this

pokeCodeCave = @"movss [0x{0:X}],xmm0
        fld dword [0x{0:X}]
        fld dword [0x{1:X}]
        faddp
        fstp dword [edi+0x0000014C]
        ret";

How can I convert/interpret the bytes?

EDIT: Well I found a way to do it and for documentation purpose: After finding dozens of ended projects I found the GitHub of 9ee1 Capstone.Net which is build on Capstone. After downloading the Projectfolder and building each of the projects, the CMD didnt allocate enough memory, so after increasing the value from 80 to 180 the exe said that it was missing capstone.dll which isn't Gee.External.Capstone.dll. I downloaded the release version 1.2.2 from their GitHub and there was a capstone.dll but this CMD didn't allocate enough memory either. So I copied the .dll files from the release to the fixed CMD.exe and now everything was working.

Now i converted my code from decimals 233,0,0,0,0,144 to hex 0xE9,0,0,0,0,0x90 and entered them in the Programm.cs X86 section, rebuild the CMD and there it was: jmp 0x1005 | nop or a little bit more complex example:

dec: 139,78,4,185,0,0,0,0,184,0,0,0,0,137,69,216,233,0,0,0,0
hex: 8B 4E 04 B9 00 00 00 00 B8 00 00 00 00 89 45 D8 E9 00 00 00 00
op: mov ecx,[esi+4] | mov ecx,0 | mov [ebp-28],eax | jmp 0x1015
c#
assembly
code-injection
asked on Stack Overflow May 22, 2018 by Cortex • edited May 22, 2018 by Cortex

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0