Assembly Language for Beginners

1.14. CONDITIONAL JUMPS

x86 + MSVC + Hiew

Wecantrytopatchtheexecutablefileinawaythatthef_unsigned()functionwouldalwaysprint“a==b”,
no matter the input values. Here is how it looks in Hiew:

Figure 1.40:Hiew:f_unsigned()function

Essentially, we have to accomplish three tasks:

• force the first jump to always trigger;


• force the second jump to never trigger;


• force the third jump to always trigger.

Thus we can direct the code flow to always pass through the secondprintf(), and output “a==b”.

Three instructions (or bytes) has to be patched:

• The first jump becomesJMP, but thejump offsetwould remain the same.


• The second jump might be triggered sometimes, but in any case it will jump to the next instruction,
  because, we set thejump offsetto 0.

In these instructions thejump offsetis added to the address for the next instruction. So if the offset

is 0, the jump will transfer the control to the next instruction.

• The third jump we replace withJMPjust as we do with the first one, so it will always trigger.