0

I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8.

I added code like this.

(Assembly)           (Hex dump)
mov eax, 638BACh --> B8 AC 8B 63 00

Not problem until now, but problem occurred when start debugging. immediate value change like this.

(Assembly)              (Hex dump)
mov eax, 0AC638BACh -->  B8 AC 8B 63 AC

What's wrong with my working?

1

When you start debugging, IDA automatically rebases your database to the actual load address of the program you are debugging. Due to ASLR, the runtime base address is very likely different from the base address IDA loaded the file to in the database. When the database gets rebased, IDA automatically patched all locations referenced by the relocation table. If the code you patched contained an absolute address before patching, you have a relocation entry for that address.

You can verify my hypothesis by undefining the move instruction. One of the resulting "db" statements will have an autogenerated "FIXUP" comment if there is a relocation entry affecting that instruction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.