I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I know that typically a static variable is stored in the
.data segment or in the
.bss segment, and the PE file headers
SizeOf(Un)InitializedData. However, I'm having a hard time finding out how to write the address of the added space in x86 assembly. Basically I'm assuming that it would be something like
mov eax, dword ptr ds:[??], but I don't know what
?? I should put there.
The other way around would be to hack and re-use some memory area inside
.data segment that hopefully isn't actually used. I tried to do this by looking at the
Memory layout tab in
x32dbg and finding the
.data segment address of the loaded DLL, then taking the address of somewhere near the end. This approach would work for seconds and the memory was indeed written, but the program crashes shortly afterwards due to some exception in
RtlFreeHeap(), which I'm also confused about because I was supposing it's the
.data segment, not the heap.
Could someone help me understand how to do this?