English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For that to work, I need to find the bytes of the instruction which references a specific static string. I need to find the bytes in file for the LEA instruction highlighted in red below:
I can't simply do a pattern search for "48 8D 15 C8 50 DA 00", because the last four bytes of the opcode change between executable versions, as the string address varies.
Finding the string offset in the file is pretty easy with an hex editor, and translating that offset into a virtual address is also very straightforward and I got that working already (converting from file offset to VA is yielding the 0x140FDE580 correctly).
The problem is actually going from this virtual address into the binary opcode of the LEA address operand (C8 50 DA 00). Since this address is relative to the current instruction position, is there any more optimized way of searching for this instruction other than iterate between each instruction, calculate the distance between EIP and the string VA and see if the current instruction address this VA offset?
Thanks in advance!