Re: [exelist] How convert a jump in a .com file to a real offset ?

["Senna Spy" <sennaspy@...>]

Hi !
This is easy :-)
I test with Visual C++ 6.0  :-)

unsigned short int offset1;
unsigned char offset2;
unsigned char cJump = '\0';

... hFile = fopen( ...., "rb" );
...

fread(&cJump, sizeof(cJump), 1, hFile );

if ( cJump == 0xE9 )
{
    fread( &offset1, sizeof(offset1), 1, hFile );
    printf( "Jump to %04x\n", offset1 + 3 );  // +3 because E9 XX XX = 3
Bytes
}
else if ( cJump == 0xEB )
{
    fread(&offset2, sizeof(offset2), 1, hFile );
    printf("Jump to %04x\n", offset2+2); // +2 because EB XX = 2 Bytes
}


I have a question... do you need this for make virus ?  :-)

[]'s
Senna Spy
http://www.avpavp.hpg.com.br



----- Original Message -----
From: "Graficos Ltda" <demonstracao@...>
To: <exelist@yahoogroups.com>
Sent: Sunday, September 23, 2001 6:53 PM
Subject: [exelist] How convert a jump in a .com file to a real offset ?


> How convert a jump in a .com file to a real offset ?
> I need check if the 3 first bytes in a .com file is a "jump", like:
> E9 XX XX   or   EB XX XX
> If yes, a need the "XX XX" to the real offset inside the file.
> The C or C++ source code is good for this routine.
>
> Thank you
>
>
> _________________________________________________________________
> Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
>
>
>
>
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>