2

I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the program gets mapped, any ideas ?

I also want to automate this, so that every time I run the program and after it gets mapped in memory, and after pushing a certain button, the value gets patched, only in memory, automatically!!

1
  • 1
    In game cheating this is quite common. You've trainers which edit the contents of process memory. You would invoke the trainer using predefined hotkeys. You can search for "game trainer creation tutorials".
    – 0xec
    Jun 13 '18 at 4:46
2

To control memory mapping events you need a debugger or kernel mode driver. I.e. you have to open the process for debug, with your own debugger in order to get the notification that some module loaded. There's a patching type called Loader it's actually works this way. https://lucasg.github.io/2016/11/27/How-to-Create-and-Debug-a-Process-on-Windows/ see the "Debug way" section

And in kernel mode driver you can subscribe to memory mapping events from the whole OS, so you're able to control all the modules in all the processes.

3
  • Could you explain which exact mechanism you mean in the last paragraph? I am unaware of such a broad mechanism. Or do you mean PsSetLoadImageNotifyRoutine?
    – 0xC0000022L
    Jun 13 '18 at 13:55
  • Yes, PsSetLoadImageNotifyRoutine. There's a way through ETW. And as I remember it's possible to see file mapping operations in FS minifilter. Jun 13 '18 at 14:27
  • 1
    Could you explain how can I use this kernel mode to control modules? - as I need to patch a DLL module while the program is running.. Could you explain how the whole process is done?
    – Ponsonnet
    Jun 13 '18 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.