..., etc.

So, check the stack at break of McpDoBetaCheck, calling funcion is McpFInitMcp.  Break on that function (break McpFInitMcp, then step (s) forward), disas the address, and start looking for the call to McpDoBetaCheck, can just look for the previous break point address or something, can't remember.

addresses need * in front for a jump.  you can break McpFInitMcp and then see what address 
you need to jump from there.

gdb ./Microsoft Entourage
break *0x01044cab
jump *0x01044cb2

that works.

NOTE: on finding the code in the decompiled text version- the last 3 characters in gdb's address correspond to the hex offset-
to find the code quickly, grep -B1 "cad:" decomp.txt|grep "jne" or grep -B1 "cad:" mcpdecomp.out|grep -B1 call | grep -A1 jne ...
SO simple, so fast.

hexedit offsets for the nop's are 1190C0 for power pc and 400CAD for intel.
nop codes are "90" for intel, and believed to be "60 00 00 00" for power pc...


Using objdump, disassemble the files, objdump -D binaryfile >decompiledoutputfile.txt.  An example command to find the necessary lines looks like:

  grep -A5 -B4 'mov    $0x1,%eax' mcpdecomp.out |grep -B5 -A4 'add    $0x4,%esp'

and the output looks like: 
  --
  106ca4:	e8 b1 71 02 00       	call   12de5a <LC_SEGMENT.__TEXT.__text+0x12ca86>
  106ca9:	85 c0                	test   %eax,%eax
  106cab:	75 05                	jne    106cb2 <LC_SEGMENT.__TEXT.__text+0x1058de>
  106cad:	e8 1c f8 ff ff       	call   1064ce <LC_SEGMENT.__TEXT.__text+0x1050fa>
  106cb2:	b8 01 00 00 00       	mov    $0x1,%eax
  106cb7:	83 c4 04             	add    $0x4,%esp
  106cba:	5b                   	pop    %ebx
  106cbb:	5d                   	pop    %ebp
  106cbc:	c3                   	ret    
  106cbd:	00 00                	add    %al,(%eax)


Open a hexeditor and search for the strings that match the opcodes in question,
e8b171020085c07505...  then replace the jne jump to nop's, 90 90.  The offset 
location in this case is 106ca4

Now, objdump the file again with power4 powerpc instruction set as an argument...

For powerpc, we're looking for the code of:
  --
  grep -A2 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B5 -A4 'bne'
  grep -A2 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A1 'bne     cr7,'
  grep -A2 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A1 'bne     cr7,' |grep bl |wc -l
      81
  grep -A3 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A2 'bne     cr7,' |grep -A1 bl

And finally we find it....

  frieda:Desktop ben$ grep -A3 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A2 'bne     cr7,' |grep -A1 bl|grep 'addi   r1,r1,80'
  frieda:Desktop ben$ grep -A3 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A2 'bne     cr7,' |grep -A1 bl|grep 'addi    r1,r1,80'
  1180c4:	38 21 00 50 	addi    r1,r1,80
  1180c4:	38 21 00 50 	addi    r1,r1,80
  frieda:Desktop ben$ grep -A3 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A2 'bne     cr7,' |grep -B4 -A2 bl|grep 'addi    r1,r1,80'
  1180c4:	38 21 00 50 	addi    r1,r1,80
  1180c4:	38 21 00 50 	addi    r1,r1,80
  frieda:Desktop ben$ grep -A3 'cmpwi   cr7,r3,0' power4decomp.txt|grep -B1 -A2 'bne     cr7,' |grep -B4 -A2 bl|grep -A4 -B4 'addi    r1,r1,80'
  --
  1180b8:	2f 83 00 00 	cmpwi   cr7,r3,0
  1180bc:	40 9e 00 08 	bne     cr7,1180c4 <LC_SEGMENT.__TEXT+0x1180c4>
  1180c0:	4b ff fa 31 	bl      117af0 <LC_SEGMENT.__TEXT+0x117af0>
  1180c4:	38 21 00 50 	addi    r1,r1,80
  --
  --
  --
  1187e8:	2f 83 00 00 	cmpwi   cr7,r3,0
  --
  --
  1180b8:	2f 83 00 00 	cmpwi   cr7,r3,0
  1180bc:	40 9e 00 08 	bne     cr7,1180c4 <LC_SEGMENT.__TEXT.__text+0x115e84>
  1180c0:	4b ff fa 31 	bl      117af0 <LC_SEGMENT.__TEXT.__text+0x1158b0>
  1180c4:	38 21 00 50 	addi    r1,r1,80
  --
  --
  --
  1187e8:	2f 83 00 00 	cmpwi   cr7,r3,0






  0x01044ca9 <McpFInitMcp+57>:	test   %eax,%eax
  0x01044cab <McpFInitMcp+59>:	jne    0x1044cb2 <McpFInitMcp+66>
  0x01044cad <McpFInitMcp+61>:	call   0x10444ce <McpDoBetaChecc>
  0x01044cb2 <McpFInitMcp+66>:	mov    $0x1,%eax
..., etc.

User Tools

Site Tools

Page Tools
