I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I know that typically a static variable is stored in the .data
segment or in the .bss
segment, and the PE file headers SizeOf(Un)InitializedData
. However, I'm having a hard time finding out how to write the address of the added space in x86 assembly. Basically, I'm assuming that it would be something like mov eax, dword ptr ds:[??]
, but I don't know what ??
I should put there.
The other way around would be to hack and re-use some memory area inside .data
segment that hopefully isn't actually used. I tried to do this by looking at the Memory layout
tab in x32dbg
and finding the .data
segment address of the loaded DLL, then taking the address of somewhere near the end. This approach would work for seconds and the memory was indeed written, but the program crashes shortly afterwards due to some exception in RtlFreeHeap()
, which I'm also confused about because I supposed it's the .data
segment, not the heap.
Could someone help me understand how to do this?
.data
section, and make your instruction accordingly? for the crash issue, maybe you assume wrongly that this space is not used, and in fact, at some point, it's used to store a heap pointer, which is sent to free function.IDA
/Ghidra
to the.data
section and see the x-refs