1

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.

I know that typically a static variable is stored in the .data segment or in the .bss segment, and the PE file headers SizeOf(Un)InitializedData. However, I'm having a hard time finding out how to write the address of the added space in x86 assembly. Basically I'm assuming that it would be something like mov eax, dword ptr ds:[??], but I don't know what ?? I should put there.

The other way around would be to hack and re-use some memory area inside .data segment that hopefully isn't actually used. I tried to do this by looking at the Memory layout tab in x32dbg and finding the .data segment address of the loaded DLL, then taking the address of somewhere near the end. This approach would work for seconds and the memory was indeed written, but the program crashes shortly afterwards due to some exception in RtlFreeHeap(), which I'm also confused about because I was supposing it's the .data segment, not the heap.

Could someone help me understand how to do this?

  • Why don't you look at the other references to the global variables in .data section, and make your instruction accordingly? for the crash issue, maybe you assume wrongly that this space is not used, and in fact, at some point, it's used to store a heap pointer, which is sent to free function. – macro_controller Feb 12 at 10:22
  • @macr0controller Because the DLL is big and really likes passing pointers around, which gave me a hard time for days. Do you know a good way to identify .data section usage? – Hai Zhang Feb 12 at 11:22
  • 2
    Just go to IDA/Ghidra to the.data section and see the x-refs – macro_controller Feb 12 at 12:59
  • Remember you'll probably need to patch the base relocation table too. – Ian Cook Feb 16 at 10:36
0

Inspecting the bss with ghidra will surely allow you to understand who is referencing what.

Without symbols it could be hard to infer whether allegedly unused space within the segment is part of more complex structures.

For this reason I suggest extending it via Ida or any PE editor. once you have the space, you can use the cross-references previously inferred to compute the address to use. You have to mimick the pattern, just increasing the reference value with the difference between your newly allocated space (the first byte) and and the cross reference you choose (the first byte).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.