How to jump to a new empty memory that related to the program to write another code there?

Question

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another empty memory that related to my program to write the new code there.

How do I know/reserve an empty memory that related to my program to write the new code?

Answer 1

Get Yourself Acquainted with the Binary Format Two Major Formats Are
PE or COFF for Windows
ELF For Linux

A Windows PE Section Named .xyz might have the following properties

SECTION HEADER #1
    .xyz name
      15 virtual size
    1000 virtual address (00401000 to 00401014)
     200 size of raw data
     200 file pointer to raw data (00000200 to 000003FF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read

a Section is normally Aligned on a 0x200 bytes in the physical binary
a Section is normally mapped with an alignment of 0x1000 by the windows loader when you execute the binary

this space of either

( sizeof(RawData) - sizeof(VirtualSize) ) or
( sizeof(PageSize) - sizeof(VirtualSize) )

is inherently available for Manipulation

in the section header above you either have physical and permanent modifiable space of

:\>python -c print(hex(0x200-0x15))
0x1eb 

or a transient temporarily modifiable space of

:\>python -c print(hex(0x1000-0x15))
0xfeb

just as confirmation you can dump 50 bytes from this .xyz section
which is located at 0x200 in the physical file and
Notice after the VirtualSize of 0x15 it is filled with 0x00 (NULLS) upto 0x400 (The File Alignment Size)

:\>xxd -s 0x200 -l 0x50 -g 0x16 winmsgbox.exe
00000200: 558bec6a006a006a006a00ff15002040  U..j.j.j.j.... @
00000210: 005dc210000000000000000000000000  .]..............
00000220: 00000000000000000000000000000000  ................
00000230: 00000000000000000000000000000000  ................
00000240: 00000000000000000000000000000000  ................

0x215 to 0x3ff is free in the section shown above 


:\>xxd -s 0x3f0 -l 0x20 -g 0x16 winmsgbox.exe
000003f0: 00000000000000000000000000000000  ................
00000400: fc200000000000000000000000000000  . ..............

since this section is already an Executable Section you can add your code in this Section and execute it without worrying about Page Protection Limitations enforced by the system.

you can either physically modify the binary using a hex editor up to 0x1eb bytes
or
patch it in Memory up to 0xfeb bytes

the sample code below is a simple MessageBox with no Message or Caption compiled using vs 2017 as x86 (32bit) from which the Section Header is Displayed above

:\>ls -lg
total 2
-rw-r--r-- 1 197121 130 Jun 20 19:51 complink.bat
-rw-r--r-- 1 197121 215 Jun 20 20:08 winmsgbox.cpp

:\>type winmsgbox.cpp
#include <windows.h>
#pragma comment(lib, "user32.lib")
#pragma code_seg(".xyz")
int WINAPI WinMain(_In_ HINSTANCE, _In_opt_ HINSTANCE, _In_ LPSTR, _In_ int)
{
    return MessageBoxW(NULL, NULL, NULL, NULL);
}


:\>type complink.bat
del *.exe
cl /W4 /analyze:autolog- /Od /nologo /GS- %1.cpp /link /release /ENTRY:WinMain /SUBSYSTEM:Windows /FIXED
del *.obj

on execution The Message box will display a caption of System Default String "Error"

as below

think of ways and means to Change the Caption to "Success"

one possible way is to recompile it with required info rip the bytes paste and adjust another possible way is to hexedit the strings calculate offsets and Detour

any other ways ?