CODEWITHSUNDEEP
assemblyx86
user1600687
user1600687

Reputation: 1

Ollydbg Unkown identifier error

10002579   . 6A 00          PUSH 0
1000257B   . 68 59020000    PUSH 259
10002580   . 8B11           MOV EDX,DWORD PTR DS:[ECX]
10002582   . 6A 00          PUSH 0
10002584     6A 05          PUSH 5
10002586     50             PUSH EAX
10002587     FF52 18        CALL DWORD PTR DS:[EDX+18]
1000258A     84C0           TEST AL,AL
1000258C     75 2B          JNZ SHORT Pigeon.100025B9
1000258E     8B4E 10        MOV ECX,DWORD PTR DS:[ESI+10]
10002591   . 68 D5070000    PUSH 7D5
10002596   . 68 0000FF00    PUSH 0FF0000
1000259B   . 68 90640110    PUSH Pigeon.10016490     ;ASCII "STR_PIGEON_SEND_ERR_NOEMONEY"
100025A0   . 8B39           MOV EDI,DWORD PTR DS:[ECX]
100025A2   . FF15 04300110  CALL DWORD PTR DS:[<&Common.CnStrGet>]   ;  Common.CnStrGet
100025A8   . 8B9424 5C04000>MOV EDX,DWORD PTR SS:[ESP+45C]
100025AF   . 83C4 04        ADD ESP,4
100025B2   . 50             PUSH EAX
100025B3   . 52             PUSH EDX
100025B4   . E9 30020000    JMP Pigeon.100027E9
100025B9   > 8B46 10        MOV EAX,DWORD PTR DS:[ESI+10]

I need to change push 5 on 10002584 to push c350 but i am getting unknown identifier error on ollydbg

When I used 0xC350 this below codes change and the dll file don't run it properly.

How to do that ?

Upvotes: 0

Views: 1776

Answers (1)

Alexey Frunze
Alexey Frunze

Reputation: 62068

push 0xc350 clearly needs more than 2 bytes (which is the length of push 5) to be encoded. It needs 5 bytes.

You cannot squeeze these 5 bytes into the 2-byte space. If you try, you will overwrite and corrupt the following instructions:

10002586     50             PUSH EAX
10002587     FF52 18        CALL DWORD PTR DS:[EDX+18]

You will need to replace push 5 (and possibly the following instructions) with jmp to a location that will have push 0xc350 (and the instructions overwritten by that jmp, if any) and jmp back.

Upvotes: 1

Related Questions