1

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another empty memory that related to my program to write the new code there.

How do I know/reserve an empty memory that related to my program to write the new code?

4
  • Are you wanting to patch a binary on disk and then run that patched binary, or are you wanting to patch a binary at runtime?
    – saquintes
    Jun 16 at 8:49
  • @saquintes: Patching at runtime.
    – Lion King
    Jun 16 at 11:17
  • There is a lot of nuance in finding a space, but one option might be to find the end of the .text section and use any slack space that might there. Pages are allocated in 4K blocks, so if the last page only uses 2K, you might have 2K to work with.
    – saquintes
    Jun 16 at 18:33
  • @saquintes: Sorry, but maybe that talking is ambiguous to me. Could you clarify that ambiguity in more detail?
    – Lion King
    Jun 17 at 3:17
0

Get Yourself Acquainted with the Binary Format Two Major Formats Are
PE or COFF for Windows
ELF For Linux

A Windows PE Section Named .xyz might have the following properties

SECTION HEADER #1
    .xyz name
      15 virtual size
    1000 virtual address (00401000 to 00401014)
     200 size of raw data
     200 file pointer to raw data (00000200 to 000003FF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read

a Section is normally Aligned on a 0x200 bytes in the physical binary
a Section is normally mapped with an alignment of 0x1000 by the windows loader when you execute the binary

this space of either

( sizeof(RawData) - sizeof(VirtualSize) ) or
( sizeof(PageSize) - sizeof(VirtualSize) )

is inherently available for Manipulation

in the section header above you either have physical and permanent modifiable space of

:\>python -c print(hex(0x200-0x15))
0x1eb 

or a transient temporarily modifiable space of

:\>python -c print(hex(0x1000-0x15))
0xfeb

just as confirmation you can dump 50 bytes from this .xyz section
which is located at 0x200 in the physical file and
Notice after the VirtualSize of 0x15 it is filled with 0x00 (NULLS) upto 0x400 (The File Alignment Size)

:\>xxd -s 0x200 -l 0x50 -g 0x16 winmsgbox.exe
00000200: 558bec6a006a006a006a00ff15002040  U..j.j.j.j.... @
00000210: 005dc210000000000000000000000000  .]..............
00000220: 00000000000000000000000000000000  ................
00000230: 00000000000000000000000000000000  ................
00000240: 00000000000000000000000000000000  ................

0x215 to 0x3ff is free in the section shown above 


:\>xxd -s 0x3f0 -l 0x20 -g 0x16 winmsgbox.exe
000003f0: 00000000000000000000000000000000  ................
00000400: fc200000000000000000000000000000  . ..............

since this section is already an Executable Section you can add your code in this Section and execute it without worrying about Page Protection Limitations enforced by the system.

you can either physically modify the binary using a hex editor up to 0x1eb bytes
or
patch it in Memory up to 0xfeb bytes

the sample code below is a simple MessageBox with no Message or Caption compiled using vs 2017 as x86 (32bit) from which the Section Header is Displayed above

:\>ls -lg
total 2
-rw-r--r-- 1 197121 130 Jun 20 19:51 complink.bat
-rw-r--r-- 1 197121 215 Jun 20 20:08 winmsgbox.cpp

:\>type winmsgbox.cpp
#include <windows.h>
#pragma comment(lib, "user32.lib")
#pragma code_seg(".xyz")
int WINAPI WinMain(_In_ HINSTANCE, _In_opt_ HINSTANCE, _In_ LPSTR, _In_ int)
{
    return MessageBoxW(NULL, NULL, NULL, NULL);
}


:\>type complink.bat
del *.exe
cl /W4 /analyze:autolog- /Od /nologo /GS- %1.cpp /link /release /ENTRY:WinMain /SUBSYSTEM:Windows /FIXED
del *.obj

on execution The Message box will display a caption of System Default String "Error"

as below

enter image description here

think of ways and means to Change the Caption to "Success"

one possible way is to recompile it with required info rip the bytes paste and adjust another possible way is to hexedit the strings calculate offsets and Detour

any other ways ?

6
  • I tried to change that word from "error" to "success" but I have failed, I must first allocate memory to store the word then changing the instruction that gets the "error" word from memory. That's what I thought. (I have used x64dbg for that work).
    – Lion King
    Jun 21 at 3:14
  • well think if you really need to allocate memory i already hinted you you have 0x1eb free space by way of FileAlignment
    – blabb
    Jun 21 at 3:56
  • But this range 0x15 to 0x200 has data! take a look ScreenShot, (1) is that data not important if I overwrite it? (2) Also, is this range available to be overwritten with all executable files?
    – Lion King
    Jun 21 at 20:45
  • well you need basics please go to the drawing board and memorize multiplication tables aka pe header format this qa web service is not a suitable format for a lengthy tete a tete take a look at 215 to 3ff in the compiled code i provided you cannot use a size small t shirt on a sumo wrestler or. use a sumo wrestller's boxers for a lean slim and trim boy
    – blabb
    Jun 22 at 1:30
  • I did my best to change the string from "error" to "success" but the final executable file becomes corrupt. the instruction that loads the "error" word is in a DLL file named ntdll.dll and it's impossible to change anything in that DLL file. Am I took the correct path or I took the wrong path?
    – Lion King
    Jun 23 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.