Error when changing push 0 to push function

Question

Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure

I've searched for a fix for a while to no avail help would be much appreciated.

score 0 · Answer 1 · answered Sep 28 '19 at 19:44

The problem is that you are changing 2 bytes instruction push 0 into push offset which is 5 bytes instruction. So you overwrite subsequent instruction’s prefix and that’s why sp analysis fails (push offset Studio_done changed to db 0 and pop, so you have pop instead of push).

score 0 · Accepted Answer · answered Sep 29 '19 at 11:36

0

Turn on bytes. You'll see you don't have enough space. You're going to have to figure out where to steal some. Wherever that is, via jump short, you need a couple more bytes.

answered Sep 29 '19 at 11:36

J.Hirsch

168
6

How do I turn on bytes? – DavidTheTech Oct 06 '19 at 16:45
Try this question: https://reverseengineering.stackexchange.com/questions/14422/how-do-i-know-the-bytes-corresponding-to-an-instruction-in-hex-view-in-ida – J.Hirsch Oct 07 '19 at 14:23

Error when changing push 0 to push function

2 Answers2