I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:
mov r8d, 0Ah ; lpType
mov edx, 0h ; lpName
xor ecx, ecx ; hModule
call cs:FindResourceW
mov [rsp+148h+var_B8], rax ; using existing var_B8 to store hResInfo
mov rdx, [rsp+148h+var_B8] ; hResInfo
xor ecx, ecx ; hModule
call cs:LoadResource
mov [rsp+148h+var_B0], rax ; using existing var_B0 to store hResData
mov rcx, [rsp+148h+var_B0] ; hResData
call cs:LockResource
; data is now in location referenced by RAX register
The first problem seems to be the "Assemble" function in IDA pro doesn't handle 64-bit operands, so instructions such as mov r8d, 0Ah I have to assemble by hand and patch via bytes.
However I am not sure how to easily generate the call cs:FindResourceW instruction. While the "assembly" feature generates code the disassembly shows it as gibberish, call instruction "assembled" at 00000272D0B83B4C:
.text:00000272D0B83B3F mov r8d, 0Ah
.text:00000272D0B83B45 mov edx, 0
.text:00000272D0B83B4A xor ecx, ecx
.text:00000272D0B83B4A ; ---------------------------------------------------------------------------
.text:00000272D0B83B4C db 9Ah ; š
.text:00000272D0B83B4D db 40h ; @
.text:00000272D0B83B4E db 94h ; ”
.text:00000272D0B83B4F db 0BDh ; ½
.text:00000272D0B83B50 db 0D0h ; Ð
.text:00000272D0B83B51 db 6
.text:00000272D0B83B52 db 0
.text:00000272D0B83B53 db 89h ; ‰
.text:00000272D0B83B54 db 84h ; „
.text:00000272D0B83B55 ; ---------------------------------------------------------------------------
.text:00000272D0B83B55 and al, 89h
.text:00000272D0B83B55 ; ---------------------------------------------------------------------------
.text:00000272D0B83B57 db 45h ; E
.text:00000272D0B83B58 db 8
To currently assembly I am taking location from import table:
.idata:00000272D0BD9440 ; HRSRC __stdcall FindResourceW(HMODULE hModule, LPCWSTR lpName, LPCWSTR lpType)
.idata:00000272D0BD9440 extrn FindResourceW:qword
Subtracting location where I will insert my code, and subtract 6.
272D0B83B4A (Code location)
-272D0BD9440 (Import table location)
-6
===========
00 05 58 F0
I am then patching with FF 15 followed by the result in reverse order such as inserting bytes:
FF 15 F0 58 05 00
This works but is time consuming, is there any better patching option for inserting call instructions quickly.