Free World Dialup - www.freeworlddialup.com and sign up to get your FWD # and password.
2 - Download brands.xten.net/x-litefwd/download/X-LiteFWD_Install.exe FWD/X-Lite (”self-configures”) program or go to www.myphonebooth.com/ to call any FWD # and U.S. toll free #s usin’ Internet Explorer (Firefox not supported).

Quickstart Guide: www.freeworlddialup.com/support/quick_start_guide

FWD Xlite Configuration Guide:

www.freeworlddialup.com/support/configuration_guide/configure_your_fwd_certified_phone/fwd_xlite/all
MS Windows Messenger Configuration Guide: pulver.com/fwd/fwd30news.html#messenger (FWD supports Windows Messenger 4.6/4.7 but not MSN Messenger 5.x.)

3 - To call a U.S. landline/cell #, dial *+areacode+7digit#. (This FWD feature is not listed on deir website, but has been workin’ for several months now.)

4 - To call a FWD # from a PSTN (your regular phone), click
www.dslreports.com/r0/download/476274~3ccc4c9edbe2a596714a4fd9da897204/fwdaccessnumbers.zip or after you’ve signed up go to FWD web page, click on “Features”, “Access #s” for a list of FWD access numbers in your area. Available in several states in de U.S., UK, NL and DE at this time.

Packet8:

– To call a P8 phone # from a FWD phone: Dial **898 + 1 + P8 number to be routed to P8 service.
– To call a FWD # from a P8 phone:
*If de FWD # you are callin’ contains 5 digits, start to dial with de prefix 0351. For example: 035112345
*If de FWD # you are callin’ contains 6 digits, start to dial with de prefix 0451.

Call UK:

Get a UK telephone # that will call you on your FWD #. Register fwd.calluk.com.

FWD Features: Some features like Voice email needs to be activated at www.fwdnet.net

Internet Callin’
Call Waitin’
CallerID
Missed Call notification
Call Forwardin’
Call Transfer
Three Way Callin’
Voice email
SoftPhone, IP Phones & *Web-based
Aliases
Whitepages directory
ENUM Entry
eDial SOAP
Conferencin’
Instant Messagin’
Web Callin’/FWD-Talk
Corporate Cisco Call Manager Connection
Callin’ to Toll Free Numbers in de UK, US, NL, JP and FR TellMe Service (411).
– NL Dial *31(800)… to reach Nederlands toll free #s.
– UK Dial *44(800)… or *44(808)… or *44 (500) to reach UK toll free #s.
– US Dial *1(8xx) xxx xxxx to reach United States toll free #s.
– JP Dial *81 0120… to reach Japan toll free #s.

Frequently used numbers
613 Echo test
55555 Volunteer Welcome Line
514 FWD Coffee House
612 Time
411 TellMe Information
611 Part Time Technical support
511 FWD Conference Bridge

At de moment, I think this is way better than Skype, Yahoo IM voice chat, etc…I’ve been usin’ FWD for over a year with my cable broadband service and didn’t have to set up any port forwardin’ on my broadband router. Obviously you’ld need a mic/speakers connected to your PC.

You can also use your regular telephone via an adapter voipstore.pulver.com/product_info.php?products_id=32 and IP phone voipstore.pulver.com/product_info.php?products_id=33. Adapters and IP phones from different vendors like Cisco are available.

* Broadbandreports.com VoIP forum (formerly known as DSLReports.com)
– If you have any questions or just curious about VoIP, visit de VoIP forum www.dslreports.com/forum/voip at DSLReports.com.

This tutorial is more of a tip than a tutorial. It just explains how to calculate offsets for jumps and calls within de program you are patchin’.

Types of Jumps/Calls

Here I will just describe de different types of jumps and calls which you will come across:

Short Jumps
Short jumps be dey conditional or unconditional jumps are 2 bytes lon’ (or 1 nibble if your Californian . These are relative jumps taken from de first byte after de two bytes of de jump. Usin’ short jumps you can jump a maximum of 127 bytes forward and 128 bytes backwards.

Lon’ Jumps
Lon’ jumps if dey are relative are 6 bytes lon’ for conditional jumps and are 5 bytes lon’ for unconditional jumps. For conditional jumps 2 bytes are used to identify that it is a lon’ jump and what type of jump (je, jg, jns etc) it is. The oder 4 bytes are used to show how far away de target location is relative to de first byte after de jump. In an unconditional jump only 1 byte is used to identify it as a lon’ unconditional jump and de oder 4 are used to show it’s target’s relative position, as with de conditional jumps.

Calls
There are two different types of calls which we will use. The normal type of call works de same as de lon’ jumps in that it is relative to it’s current position. The oder type gives a reference to a memory location, register or stack position which holds de memory location it will call. The position held by de later is direct e.g. de memory location referenced may contain 401036h which would be de exact position that you would call, not relative to de position of de call. The size of dese types of calls depends on any calculations involved in de call i.e. you could do: ‘call dword ptr [eax * edx + 2]’. Lon’ jumps can also be made usin’ this method, but I didn’t say that earlier as to avoid repetition.

Tables
Here is a brief list of all de different types of jumps/calls and deir appropriate op-codes. Where different jumps have de same Op-Codes I have grouped them:

Jump Description Short Op-Code Lon’ Op-Code
call procedure call E8xxxxxxxx N/A
jmp u nconditional jump EBxx E9xxxxxxxx
ja/jnbe jump if above 77xx 0F87xxxxxxxx
jae/jnb/jnc jump if above or equal 73xx 0F83xxxxxxxx
jb/jc/jnae jump if below 72xx 0F82xxxxxxxx
jbe/jna jump if below or equal 76xx 0F86xxxxxxxx
jcxz/jecxz jump if cx/ecx equals zero E3xx N/A
je/jz jump if equal/zero 74xx 0F84xxxxxxxx
jne/jnz jump if not equal/zero 75xx 0F85xxxxxxxx
jg/jnle jump if greater 7Fxx 0F8Fxxxxxxxx
jge/jnl jump if greater or equal 7Dxx 0F8Dxxxxxxxx
jl/jnge jump if less 7Cxx 0F8Cxxxxxxxx
jle/jn’ jump if less or equal 7Exx 0F8Exxxxxxxx
jno jump if not overflow 71xx 0F81xxxxxxxx
jnp/jpo jump if no parity/parity odd 7Bxx 0F8Bxxxxxxxx
jns jump if not signed 79xx 0F89xxxxxxxx
jo jump if overflow 70xx 0F80xxxxxxxx
jp/jpe jump if parity/parity even 7Axx 0F8Axxxxxxxx
js jump if sign 78xx 0F88xxxxxxxx

Calculatin’ Offsets (findin’ in de xx’s in table)

You will need to be able to calculate offsets when you add jumps and make calls within and to de code you have added. If you choose to do this by hand instead of usin’ a tool den here are de basics:

For jumps and calls furder on in memory from your current position you take de address where you want to jump/call and subtract from it de memory location of de next instruction after your call/jump i.e.:

(target mem address) - (mem location of next instruction after call/jump)

Example
If we wanted to jump to 4020d0 and de next instruction *after* de jump is at location 401093 den we would use de followin’ calculation:

4020d0 - 401093 = 103d

We den write de jump instruction in hex as e93d100000 where e9 is de hex op-code for a lon’ relative jump and 3d100000 is de result of our calculation expanded to dword size and reversed.

For jumps and calls to locations *before* de current location in memory you take de address you want to call/jump to and subtract it from de memory location of de next instruction after your call/jump, den subtract 1 and finally perform a logical NOT on de result i.e.

NOT(mem address of next instruction - target mem address - 1)

Example
If we wanted to call location 401184 and de address of de next instruction after de call is 402190 den we do de followin’ calculation:

NOT(402190 - 401184 - 1 ) = ffffeff4

We can den write our call instruction in hex as e8f4efffff where e8 is de hex op-code for relative call and f4efffff is de result of de calculation in reverse order.

If you want to practice with different examples den de best way to do this is to use a disassembler like WDASM which shows you de op-codes and try and work out de results yourself. Also as an end note you don’t have to perform dese calculations if you have enough room to make your jump or call instruction into an absolute jump call by doin’ de followin’ as represented in assembler:

mov eax, 4020d0
call eax (or jmp eax)

Final Notes

Make life easier and use a program to do this