I want to insert instructions but don't have enough space to do so

Question

Sorry if it is a very basic question/bad place to ask/for my bad english.

I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes somewhere where I could jump to and insert the new instructions, then jump back to where I was. But it turns out I now need more space than what is available as undefined memory in the program. I've tried to add some bytes at the end of the project inside Ghidra but it doesn't seem possible at all (only editing is possible?), can someone confirm this?

I feel like I could probably add those bytes manually inside the executable with HexEdit, then reimport the exe inside Ghidra and reanalyze it, but it sounds like bad practice?

I'm interested in knowing how people usually go about this since I'm still a beginner and I'm eager to learn. Thanks.

Answer 1

Adding extra bytes at the end of the file doesn't work at all because it's an overlay data and you're not be able to execute any code there, Hence If you need more space to write your patch bytes into it, you can create a new section and set its characteristics to executable and readable, then jump into it, apply your patches and jump back where you were. There are a lot of tools you can use but I always use CFF Explorer for this purpose, you can go to 'Section Headers' right click on right side and then 'Add Section (Empty space)' enter any value of bytes which you need, then change the characteristics to '60000020' which is 'Is executable', 'Is readable' and 'Contains code' do whatever you want. The other way is to find a 'DLL Hijack' and by abusing this vulnerability patch your file in the memory or you can use a loader instead, you can try patch makers(diablo2oo2's Universal Patcher, At4re Patcher, etc.) for this purpose or write it by yourself.