This is the function:
loc_BA060: ; status xor edi, edi call _exit
How can one replace exit with continue?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
As stated in the comments by others, this depends what you mean exactly by "continue". I see this having 2 possible meanings:
jmp, making sure things line up.
call exit. In this case, you want that instruction to have no effect, so "no-operation". Thus,
If this is the entire function, it seems you would want to nullify it. Make it just not call
You could do that by simply replacing the
call _exit instruction with multiple
nop opcodes. In IDA, you'll need to use the patch program feature Under the
edit-> patch bytes sub-menu (Notice that in older versions of IDA you had to manually turn it on before it was available, this is no longer the case, though).
You could either
call instruction, the entire function (both
xor) or even completely remove the
call loc_BA060 that leads to the function at
your mileage may vary, however, depending on the surrounding code. It may be the case the prior to the call (and the following
exit()), eax contained a meaningful value that is used further down the code execution line. If that's the case and you leave the
xor eax, eax instruction intact, you'll only avoid the
exit() to hit a crash. It's therefore important to review the code surrounding the instruction you wish to remove.
Additionally, in this specific case,
exit() is a no-return-function. This means the compiler is not required to make sure code following the
exit() call will function properly because it is never expected to execute and
_exit is not expected to return. You may wish to make sure you modify the code in a way that handles that well, although that behavior depends on the compiler and optimizations used.