Trying to understand some things from tinba

[Myrsire]

So first off, I'm not the best at masm, and I am still learning a lot about it. I was taking a look back at how tinba hides its registry values, and some things are baffling me here.

; Hide Value (replace by next)
	inc p2			; Next dwIndex
	inc nHdnCount	; Increase counter (for delta)
	popad
	jmp @RealRegEnumValue

So whats I think is going on here is that its taking the dwIndex of the next item in the registry, popading it onto a register, and then putting that index in place of the old index in the registry, thus hiding it? A little bit of insight here would greatly help my skid mind out a bit.

[4nxiety]

So first off, I'm not the best at masm, and I am still learning a lot about it. I was taking a look back at how tinba hides its registry values, and some things are baffling me here.

; Hide Value (replace by next)
	inc p2			; Next dwIndex
	inc nHdnCount	; Increase counter (for delta)
	popad
	jmp @RealRegEnumValue

So whats I think is going on here is that its taking the dwIndex of the next item in the registry, popading it onto a register, and then putting that index in place of the old index in the registry, thus hiding it? A little bit of insight here would greatly help my skid mind out a bit.

If I can see the entire chain, I could tell you.


See ya in the partyvan.

[Myrsire]

If I can see the entire chain, I could tell you.


See ya in the partyvan.

You can get the whole source code from here:

https://www.opensc.io/showthread.php?t=19485

That file lives in the -RootKit folder I believe. On my laptop now, so I can't check.