questions about code

Regarding #1, #2, #3, and #4, you need to download the IA-32 instruction set reference manual from Intel. You can find it here:

hxxp://www.intel.com/design/pentium4/manuals/253666.htm (part 1, A-M)
- and -
hxxp://www.intel.com/design/pentium4/manuals/253667.htm (part 2, N-Z)

#1: As the instruction set reference explains (and in detail; it is written by Intel, after all, the makers of the instructions), a CMP "compares the first source operand with the second source operand and sets the status flags in the EFLAGS register according to the results. The comparison is performed by subtracting the second operand from the first operand and then setting the status flags in the same manner as the SUB instruction." A TEST "computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result." So, basically, a TEST can only determine whether or not 2 values are equal, while a CMP can also determine which value is largest. You may wonder why TEST even exists, since CMP can do what TEST does and then some: basically, TEST is faster, though with modern processor speeds, one would never actually see a difference.

#2: Again, read Intel's description of the various comparison instructions, and then if you still don't understand, come ask again.

#3: In the instruction set reference, the description for every instruction will say what flags that instruction affects. In your example specifically, you would see that with TEST, "the OF and CF flags are set to 0. The SF, ZF, and PF flags are set according to the result," and that MOV affects no flags. Thus, the JNZ is using the results of the TEST, not the MOV.

#4: You need to use a hex editor to change the code (WinHex is generally considered the best here, though some people like HIEW for whatever reason ). ASM is just a readable (to some people, anyway ) representation of the raw numeric instructions that get fed to the CPU. In the instruction reference, you will see the byte codes for each instruction in hex. Basically, you need to figure out what byte codes correspond to the asm you want to put in the code, and use a hex editor to actually put it in. Squidge's excellent (but now defunct) RTA utility is greatly helpful here -- it shows you the byte codes for any given asm statement that you can just then copy/paste into your hex editor.

Regarding #5, generally you use a PE scanner, and it tells you what protection (if any) a program uses. Popular PE scanners are PE iDentifier by snaker (my personal favorite), UN-PACK by Snow Panther, TrID by Marco, and retool by OHPen. There are others also, but these generally do the trick. After a while, you will generally be able to recognize a protection just by it's behavior and code.

Regards,
Satyric0n