Change binary without damage [closed]

Question

How can I change (add/edit/remove) assembly instruction from binary file without damage?

I know that at binary function save on specific offset/address, so if I change something I will damage all another function.

Answer 1

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in place of unneeded bytes) or equal to the number of bytes of an instruction or group of instructions that you'd like to patch.

Take this instruction, for example:

application.exe+2F40 - 48 89 44 24 38 - mov [rsp+38],rax

As you can see, you have 5 bytes to work with: 48 89 44 24 38

How you patch those 5 bytes is up to you, whether it's writing a new instruction that uses up to 5 bytes, or NOP-ing all 5 bytes, etc. If you want that instruction to do something that takes up more than 5 bytes, then you have to look at the instructions surrounding that instruction and see if you can essentially give yourself more bytes to work with.

Example:

application.exe+2F39 - 48 8B 05 B82C0100 - mov rax,[application.exe+15BF8]
application.exe+2F40 - 48 89 44 24 38 - mov [rsp+38],rax
application.exe+2F45 - 48 83 F8 FF - cmp rax,-01

Now maybe you could come up with a way to use all those bytes (16 in total in that example) and still maintain the integrity of the surrounding data/instructions. Maybe you want to just get rid of the first instruction. So patching it could end up looking like this (notice how the offsets change to reference each byte):

application.exe+2F39 - 90 - nop
application.exe+2F3A - 90 - nop
application.exe+2F3B - 90 - nop
application.exe+2F3C - 90 - nop
application.exe+2F3D - 90 - nop
application.exe+2F3E - 90 - nop
application.exe+2F3F - 90 - nop
application.exe+2F40 - 48 89 44 24 38 - mov [rsp+38],rax 
application.exe+2F45 - 48 83 F8 FF - cmp rax,-01

It's ultimately up to you to figure out what the function you're patching is doing at any given instruction of its subroutine(s). Just make sure you keep your bytes balanced and that your instructions are doing what you expect them to do, and you should be all set.