CODE
OS:Windows XP Professional
SP: SP1
Language: french
Opcode:
-JMP ESP:
-77f8980f in Ntdll.dll
-77d46494 in User32.dll
It is an example, but this opcodes are true, based on my system...
I remind you :
CODE
* ASM Code:
*
* call eax FF D0
* call ebx FF D3
* call ecx FF D1
* call edx FF D2
* call edi FF D7
* call esi FF D6
* call esp FF D4
* call ebp FF D5
*
* call [eax] FF 10
* call [ebx] FF 13
* call [ecx] FF 11
* call [edx] FF 12
* call [edi] FF 17
* call [esi] FF 16
* call [esp] FF 14 24
* call [ebp] FF 55 00
*
* jmp eax FF E0
* jmp ebx FF E3
* jmp ecx FF E1
* jmp edx FF E2
* jmp edi FF E7
* jmp esi FF E6
* jmp esp FF E4
* jmp ebp FF E5
*
* jmp [eax] FF 20
* jmp [ebx] FF 23
* jmp [ecx] FF 21
* jmp [edx] FF 22
* jmp [edi] FF 27
* jmp [esi] FF 26
* jmp [esp] FF 24 24
* jmp [ebp] FF 65 00
*
* push eax 50
* push ebx 53
* push ecx 51
* push edx 52
* push edi 57
* push esi 56
* push esp 54
* push ebp 55
*
* push [eax] FF 30
* push [ebx] FF 33
* push [ecx] FF 31
* push [edx] FF 32
* push [edi] FF 37
* push [esi] FF 36
* push [esp] FF 34 24
* push [ebp] FF 75 00
*
* pop eax 58
* pop ebx 5B
* pop ecx 59
* pop edx 5A
* pop edi 5F
* pop esi 5E
* pop esp 5C
* pop ebp 5D
*
* ret C3
Got here: list
So please help on this....Have a nice day
