Home/ Questions/Q 8926895
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T08:05:47+00:00

I have an example program test1.exe that uses an example library test2.dll . test.dll

  • 0

I have an example program test1.exe that uses an example library test2.dll.

  • test.dll contains the functions A() and B() of the same type.
  • test1.exe calls A and then exits.

Here I’ve found the call to A():
The line which test.exe calls A
(https://i.stack.imgur.com/5W9Jd.jpg)

Now, if i’m not mistaken, I need to replace 88FDFFFF with the correct offset of B(), but how can I calculate it so that B() will be invoked instead of A()?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If this in an x86 call-relative instruction, the offset value is computed by subtracting the address of the instruction following the call (= call instruction location + 5 bytes), from the address of the target. So, you need to patch the offset to be address(B)-address(callinstruction+5).

    • 0