I have instructions which are like this
pokeEnableMap = new byte[6]{
233,
0,
0,
0,
0,
144};
and I'd like them like this:
pokeEnable = @"call 0x{0:X}
nop
nop
nop";
or this
pokeCodeCave = @"movss [0x{0:X}],xmm0
fld dword [0x{0:X}]
fld dword [0x{1:X}]
faddp
fstp dword [edi+0x0000014C]
ret";
How can I convert/interpret the bytes?
EDIT: Well I found a way to do it and for documentation purpose: After finding dozens of ended projects I found the GitHub of 9ee1 Capstone.Net which is build on Capstone. After downloading the Projectfolder and building each of the projects, the CMD didnt allocate enough memory, so after increasing the value from 80 to 180 the exe said that it was missing capstone.dll which isn't Gee.External.Capstone.dll. I downloaded the release version 1.2.2 from their GitHub and there was a capstone.dll but this CMD didn't allocate enough memory either. So I copied the .dll files from the release to the fixed CMD.exe and now everything was working.
Now i converted my code from decimals 233,0,0,0,0,144
to hex 0xE9,0,0,0,0,0x90
and entered them in the Programm.cs X86 section, rebuild the CMD and there it was: jmp 0x1005 | nop
or a little bit more complex example:
dec: 139,78,4,185,0,0,0,0,184,0,0,0,0,137,69,216,233,0,0,0,0
hex: 8B 4E 04 B9 00 00 00 00 B8 00 00 00 00 89 45 D8 E9 00 00 00 00
op: mov ecx,[esi+4] | mov ecx,0 | mov [ebp-28],eax | jmp 0x1015
User contributions licensed under CC BY-SA 3.0