3

After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to patch the binary.

But the problem is, when executing the module, ds:yyyy is not updated based on the module imagebase, and therefore an invalid address.

How can I deal with this kind of situation? Need I patch the reloc section too? Thanks.

Improve this question
2
  • 1
    Could you provide more information about the address yyyy ? Is it an address from another module, an address that changes everytime you launch the binary, or a static address ?
    – Spl3en
    Commented Jun 20, 2015 at 1:04
  • @Spl3en Thanks for reply. I have managed to solve this. It is an address that would be changed every time I launch it because of the ASLR and address relocation. I add a reloc record in relocation table and it runs well.
    – haohaolee
    Commented Jun 22, 2015 at 8:26

1 Answer 1

Reset to default
1

Answer it myself. It is actually a portable executable. And the addresses that are hard-coded will be updated every time I launch it by relocation table.

I modified the table by tools and it runs well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.