Help/Support How to replace small length instruction with large length instruction

[nomanman 0 6]

Basically i want to replace MOVS R1, #0x0 with MOV.W R1, #0x123 .since later instruction requires 4 bytes it is impossible to simply replace in HEX code.

P.S. I'm trying to hack android native library. I found most hacking tutorials here, so i'm asking this question here 

[Guest]

try simplifing it. if you want to for example get 10000 into R0 you could try

 

mov r0, #100

mul r0, r0 (multiply)

 

then nops to fill in the extra unused bytes. just my suggestion as I've never had to do this before

[nomanman 0 6]

try simplifing it. if you want to for example get 10000 into R0 you could try

mov r0, #100

mul r0, r0 (multiply)

then nops to fill in the extra unused bytes. just my suggestion as I've never had to do this before

Actually 0x123 is some magic values upon which the library activates device specific functionality. So loading value in R1 is must. And as you told

 

mov r0, #100

mul r0, r0 (multiply)

 

Wont it take more than 2 bytes?

 

I'm looking for some tuts/exps for code caving for ARM.

Updated June 8, 2015 by nomanman

[Guest]

@nomanman oh ok code caving. I didn't really understand what you were asking so I answered it to my best ability. There is a tutorial for code caving but the author wants to keep it secret. Thats all I can say about code caving or I risk myself getting in trouble with the author.

[ipaarchive.com 11.1k]

movs r0 ,#0 2 or 4 bytes?

[nomanman 0 6]

@nomanman oh ok code caving. I didn't really understand what you were asking so I answered it to my best ability. There is a tutorial for code caving but the author wants to keep it secret. Thats all I can say about code caving or I risk myself getting in trouble with the author.

No problems. Can you tell me the name author so that i can contact him?

movs r0 ,#0 2 or 4 bytes?

Aren't all thumb instructions 16-bits?

Please shade more light on this because i'm new to ARM architecture 

[Guest]

No problems. Can you tell me the name author so that i can contact him?

 

Aren't all thumb instructions 16-bits?

Please shade more light on this because i'm new to ARM architecture 

check your PM for who to contact