1

I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block the JMP with a byte-patch. There is a screen of the address below. Thanks in advance ! Address ASM

Improve this question
6
  • Have you patched all 5 bytes of JMP opcode?
    – bart1e
    Jan 28, 2020 at 17:27
  • Yes, I do. But if I NOP the JMP the game crash because it corrupt the function. So I need to find an other byte/way to patch the JMP but idk
    – Beebey
    Jan 28, 2020 at 17:29
  • Could you show the code that JMP jumps to?
    – bart1e
    Jan 28, 2020 at 17:32
  • Yes, of course. The JMP jump into an address and the address jump into and address too. Here's a screen of the second jump result : prnt.sc/qu53i8 (if I don't bypass the JMP I'm banned ^^)
    – Beebey
    Jan 28, 2020 at 17:36
  • I think it would help to have a bit more context. It's looks like the JMP where the actual code gets executed so maybe the whole function call is not needed? But that's difficult to tell from such limited view of the code. Show more code
    – Paweł Łukasik
    Jan 28, 2020 at 19:10

2 Answers 2

Reset to default
1

Your problem is that you change the expected flow of the program - By patching the JMP you completely change the flow - it's not a call so the original flow doesn't get back to the push rdi instruction, but after patching it does, so the behavior is not expected. Try to look for what happens in 7FFCAE2A0F13, and maybe to patch inside.

Improve this answer
0

There are two issues here. One, as macr0controller notes, is that the jump might be to essential code that runs before the routine.

The second is that the jump might not be a fixed address, meaning that there's a relocation item that points to it, so any NOPs that you write will be replaced with what becomes garbage instructions if you replace the 0xE9 instruction with a NOP as well.

Instead, you could change the 0xE9 (JMP) to an instruction of equivalent length such as 0x3D (CMP EAX, imm32) which alters no registers and will not be affected by the following values.

Improve this answer
1
  • Hello ! Thanks for the answer. I tried 0x3D but the game still crash (cmp eax, 100) ... So, I've to patch inside the JMP or replace by something else than CMP EAX, imm32 ?
    – Beebey
    Feb 4, 2020 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.