I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point.
Do I just have to add it to a free spot in the memory dump and store its address in EAX? Or should open the file with a hex editor and add my string to the end and then somehow reference to that address?
The problem is that I don't really have grasp on what these dump windows mean. Why are there 5 and what's inside?
I don't know how to do it in x64dbg, but here is another way to achieve it.
Open your ocx (dll) file in Resource Hacker and you should see the resorces within your dll file. Then click Create Resources from Blank Script button and type there:
your_res_name RCDATA
{
"the_very_long_string_you_want_to_add\0"
}
And click Compile Script button (or press F5 instead). Then save the file and now your dll should contain the resource you have just created. Additionally, a copy of your original dll will be created with a name nameOfYourDllFile_original.dll.
Now, you just have to get the address of the previously inserted string - you may use IDA (and many other tools) for this.
After doing that, it is time to patch the binary - just find the place where you would like to move the string address to eax and just replace bytes with mov eax, address instruction.
Note1: I suppose you just want to change mov eax, addr_of_some_string to mov eax, addr_of_your_string - in that case you may just change the last 4 bytes of the instruction opcode, such that they contain relevant address. However, when it's not the case, you have to be very careful with patching, so that you do not overwrite any important instructions.
Note2: You may want to add multiple strings as a resource if you wish - see link for more information.
