0

Sorry if this is a dumb question I'm new to assembly.

Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment I want to return is always changing after system restart. For example currently it is .data:018C74F1 byte_18C74F1, next time it's going to differ like .data:16874F1 byte_16874F1. So due to this I am unable to change the return value to that in the file. Is there any way to workaround this?

Thank you very much for any answer given!

Improve this question

1 Answer 1

Reset to default
0

What you are observing is the effect of ASLR. You should focus on the instructions which access this memory location. To put simply:

  • on x86, you will find some .reloc entries pointing to these instructions;
  • on x64, the memory operand is RIP related (this is hidden in IDA by default).

Since you tagged ollydbg, I'm guessing this is for x86, and the 'bad' news is it's more tedious to patch than for x64. The main reason is related to how the .reloc is working. When you application is loading, the loader will find a different base image and will apply relocations. Basically (really simplified) it takes 32-bit values and adjust them accordingly to the base address. Those values are offsets inside an instruction. If you modify/patch the instruction and change the offset location (or remove it), the .reloc will corrupt the instruction.

Another solution is creating a new thread and keep modifying this memory location, this is what most trainers do.

Improve this answer
4
  • Thank you for the answer! What I realised tho if I just change the address to the correct one and save it to an exe with olly then next time that address is going to automatically relocated to the correct one, not reverted, but If I write my code at the end of the file where some free spaces left then the address stays. Maybe do you know what causing this?
    – Sejt
    Commented Jan 26, 2021 at 11:04
  • What I mean is if am using something like MOV AL,BYTE PTR DS:[1363DA0] at the free spaces down, next time on rebase/system restart it is not going to differ thus my code won't work, but If I put anywhere above that, the address is going to change to something like DS:[4378DA0] which is correct. I don't know why it happens because at the bottom the instructions I put executing without any problem, only the memories not changing there which is my issue.
    – Sejt
    Commented Jan 26, 2021 at 11:16
  • Reloc applies at a specific address, in your free spaces, you won't find any entries for it. You can add a new entry in the .reloc section, but it might be a bit tricky. Another solution is to calculate the address during run-time. To do so, use a common snippet: call $+5 ; pop reg ; mov al, byte[ds:reg+n] The call $+5 might differ depending on the assembler, and to calculate n you have to apply this formula dst - addr of pop reg. You can use a label to make the assembler calculates the offset for you. Good luck :)
    – wisk
    Commented Jan 26, 2021 at 19:22
  • Wow thank you so much! I would have never tought about calculating the address runtime. :D
    – Sejt
    Commented Jan 26, 2021 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.