Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8.
I added code like this.
(Assembly) (Hex dump)
mov eax, 638BACh --> B8 AC 8B 63 00
Not problem until now, but problem occurred when start debugging. immediate value change like this.
(Assembly) (Hex dump)
mov eax, 0AC638BACh --> B8 AC 8B 63 AC
What's wrong with my working?
When you start debugging, IDA automatically rebases your database to the actual load address of the program you are debugging. Due to ASLR, the runtime base address is very likely different from the base address IDA loaded the file to in the database. When the database gets rebased, IDA automatically patched all locations referenced by the relocation table. If the code you patched contained an absolute address before patching, you have a relocation entry for that address.
You can verify my hypothesis by undefining the move instruction. One of the resulting "db" statements will have an autogenerated "FIXUP" comment if there is a relocation entry affecting that instruction.
