1

I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:

mov     r8d, 0Ah        ; lpType
mov     edx, 0h         ; lpName
xor     ecx, ecx        ; hModule
call    cs:FindResourceW
mov     [rsp+148h+var_B8], rax   ; using existing var_B8 to store hResInfo
mov     rdx, [rsp+148h+var_B8] ; hResInfo
xor     ecx, ecx        ; hModule
call    cs:LoadResource
mov     [rsp+148h+var_B0], rax ; using existing var_B0 to store hResData
mov     rcx, [rsp+148h+var_B0] ; hResData
call    cs:LockResource
; data is now in location referenced by RAX register

The first problem seems to be the "Assemble" function in IDA pro doesn't handle 64-bit operands, so instructions such as mov r8d, 0Ah I have to assemble by hand and patch via bytes.

However I am not sure how to easily generate the call cs:FindResourceW instruction. While the "assembly" feature generates code the disassembly shows it as gibberish, call instruction "assembled" at 00000272D0B83B4C:

.text:00000272D0B83B3F                 mov     r8d, 0Ah
.text:00000272D0B83B45                 mov     edx, 0
.text:00000272D0B83B4A                 xor     ecx, ecx
.text:00000272D0B83B4A ; ---------------------------------------------------------------------------
.text:00000272D0B83B4C                 db  9Ah ; š
.text:00000272D0B83B4D                 db  40h ; @
.text:00000272D0B83B4E                 db  94h ; ”
.text:00000272D0B83B4F                 db 0BDh ; ½
.text:00000272D0B83B50                 db 0D0h ; Ð
.text:00000272D0B83B51                 db    6
.text:00000272D0B83B52                 db    0
.text:00000272D0B83B53                 db  89h ; ‰
.text:00000272D0B83B54                 db  84h ; „
.text:00000272D0B83B55 ; ---------------------------------------------------------------------------
.text:00000272D0B83B55                 and     al, 89h
.text:00000272D0B83B55 ; ---------------------------------------------------------------------------
.text:00000272D0B83B57                 db  45h ; E
.text:00000272D0B83B58                 db    8

To currently assembly I am taking location from import table:

.idata:00000272D0BD9440 ; HRSRC __stdcall FindResourceW(HMODULE hModule, LPCWSTR lpName, LPCWSTR lpType)
.idata:00000272D0BD9440                 extrn FindResourceW:qword

Subtracting location where I will insert my code, and subtract 6.

  272D0B83B4A (Code location)
 -272D0BD9440 (Import table location)
 -6
===========
00 05 58 F0

I am then patching with FF 15 followed by the result in reverse order such as inserting bytes:

FF 15 F0 58 05 00

This works but is time consuming, is there any better patching option for inserting call instructions quickly.

Improve this question

1 Answer 1

Reset to default
2

Keypatch is a plugin for IDA that uses keystone to assemble instructions for patching. It works much better than IDA's old built-in assembler, and it should be able to handle 64-bit operands.

Improve this answer
2
  • This is perfect but I’ll have to port it to IDA 7 SDK as they seem to only support 6 still. However still should be easier than compiling by hand...
    – chentiangemalc
    Jan 2, 2020 at 21:46
  • The website says only up to 6.95, but the github repo includes 7.0 github.com/keystone-engine/keypatch fwiw, it works fine for me on 7.2
    – Avery3R
    Jan 2, 2020 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.