I've opened a simple Hello World program in IDA (Pro 7.5) like that:

    global  _main
    extern  _printf

    section .text
    push    message
    call    _printf
    add     esp, 4
    push    message2
    call    _printf
    add     esp, 4
    db  'Hello, World 1', 0xD, 0xA, 0 
    db  'Hello, World 2', 0xD, 0xA, 0

Now i've made a simple detour - moved the code and data definition to the unused end of the code segment like this:

str1  db 'Hello, World1',0Dh,0Ah,0
                                         ; DATA XREF: .text:detour↓o
str2  db 'Hello, World2',0Dh,0Ah,0
                                         ; DATA XREF: .text:00404057↓o
str3  db 'Hello, World3',0Dh,0Ah,0
                                         ; DATA XREF: .text:00404064↓o↓o
      db    0
      db    0
 ; ---------------------------------------------------------------------------

 detour:                                 ; CODE XREF: .text:_main↑j
   push    offset str1     ; "Hello, World 1\r\n"
   call    _printf
   add     esp, 4
   push    offset str2     ; "Hello, World 2\r\n"
   call    _printf
   add     esp, 4
   push    offset str3     ; "Hello, World 3\r\n"
   call    _printf
   add     esp, 4
   jmp     go_back

Leaving in the main function only the jmp code like that:

  jmp detour

And this yeiled me a problem. The output of the patched program is :

Hello, World1

Hello, World2

Hello, World3

ABh@@Hello, World2

Hello, World3

ABh@@Hello, World3


Instead just:

Hello, World 1
Hello, World 2
Hello, World 3

It turned out that the patching process just changed the last byte of each string from "00" to "0A"(line feed char)!. There is the screenshot of the data section from IDA debugger running: enter image description here

And the the code section: enter image description here That's the reason of that fucked up output. But the question is WHY does it happened?

  • 1
    How did you patch the binary? Can you elaborate more? – sudhackar Feb 16 at 14:51
  • @sudhackar Just the standard way : first selected Patch program->Change byte... and next Patch program->Apply patches to input file... – Daros911 Feb 16 at 15:19
  • @sudhackar Can You please answer my question? – Daros911 Feb 17 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.