Assuming the following lines of code: MOV DWORD PTR FS:[0],EAX CALL someRoutine MOV EAX,DWORD PTR DS:[EAX+4] CMP DWORD PTR DS:[EAX+1204],0 JE placeInCode XOR EAX,EAXMy goal is to change [someRoutine] in such a way that the JE is always taken - I specifically don't want to tamper with the code outside [someRoutine]. So just think of [someRoutine] as a set of instructions that you can freely change and adapt. I can't seem to understand how to solve this equation. If there was no MOV instruction after the call, I guess I could just go to the address [EAX+1204] and fill it with 0. But like this, there seem to be too many unknown dependencies. Any advice?
Is this code equation solvable?
disassembly
Have someRoutine perform the following actions (in C below for example purposes) --DWORD* p = (DWORD*)malloc(8);p[0] = 0;p[1] = (SIZE_T)p - 1204;return p;Obviously this is a memory-leak since the allocated memory never gets free()'d, so you wouldn't want to use this approach if someRoutine gets called often. However it's not feasible to offer a better recommendation without us knowing the memory layout of the actual program.Edit: Updated based on @tathanhdinh's suggestion.