1

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.

I know that typically a static variable is stored in the .data segment or in the .bss segment, and the PE file headers SizeOf(Un)InitializedData. However, I'm having a hard time finding out how to write the address of the added space in x86 assembly. Basically, I'm assuming that it would be something like mov eax, dword ptr ds:[??], but I don't know what ?? I should put there.

The other way around would be to hack and re-use some memory area inside .data segment that hopefully isn't actually used. I tried to do this by looking at the Memory layout tab in x32dbg and finding the .data segment address of the loaded DLL, then taking the address of somewhere near the end. This approach would work for seconds and the memory was indeed written, but the program crashes shortly afterwards due to some exception in RtlFreeHeap(), which I'm also confused about because I supposed it's the .data segment, not the heap.

Could someone help me understand how to do this?

Improve this question
5
  • Why don't you look at the other references to the global variables in .data section, and make your instruction accordingly? for the crash issue, maybe you assume wrongly that this space is not used, and in fact, at some point, it's used to store a heap pointer, which is sent to free function.
    – macro_controller
    Feb 12, 2020 at 10:22
  • @macr0controller Because the DLL is big and really likes passing pointers around, which gave me a hard time for days. Do you know a good way to identify .data section usage?
    – Hai Zhang
    Feb 12, 2020 at 11:22
  • 2
    Just go to IDA/Ghidra to the.data section and see the x-refs
    – macro_controller
    Feb 12, 2020 at 12:59
  • Remember you'll probably need to patch the base relocation table too.
    – Ian Cook
    Feb 16, 2020 at 10:36
  • This is not exactly the same scenario, but a similar approach can be applied to do what you want chentiangemalc.wordpress.com/2021/07/22/… If unsure what to patch I just making a simplistic DLL first in C or C++ and output the assembly code; then make the code modification you want, output the disassembly and compare it to give you ideas what to patch in another DLL.
    – chentiangemalc
    Aug 17, 2021 at 6:52

1 Answer 1

Reset to default
1

Inspecting the bss with ghidra will surely allow you to understand who is referencing what.

Without symbols it could be hard to infer whether allegedly unused space within the segment is part of more complex structures.

For this reason I suggest extending it via Ida or any PE editor. once you have the space, you can use the cross-references previously inferred to compute the address to use. You have to mimick the pattern, just increasing the reference value with the difference between your newly allocated space (the first byte) and and the cross reference you choose (the first byte).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.