It is not that easy, or it is rather error prone. If you are going to insert 3 bytes in place of 2 bytes, you would be better off if you do a trampoline: jump to some other place, do what you want, then jump back to the next instruction. By employing trampolining, you can also save the registers.
A small sample could be like this:
jmp SomePlace <---destroy old bytes and insert an unconditional jump
NextInst: <----|_________________________
.. |
SomePlace: |
"dancing with wolves" |
jmp NextInst <------- this will jump back to->|
In the case, if you are interested in replacing two bytes with two bytes, then almost all hex editors have some form of search and replace functionality.
Or you can write a simple script in your favorite utility.
A simple windbg example script for replacing all the push XXXX 68 XXXXXX bytes to EB FE. This example is a prototype, you need to tweak it based on the pattern you get:
.foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 }
All what this does is search the disassembly for the pattern 68?? (blind search can alter unintended data, use with caution).
When it is found, it uses the address where it was found to replace the two bytes 68XX with EB FE.
It does this for all the bytes that are found in a given range. In addition to this, it also prints out the assembly prior to modification and after modification:
# 68?? pattern search command in windbg
401000 l?0x20 start search from 0x401000 end at 401020
u place l1 disassemble one instruction when pattern found
ew place feeb write word 0xfeeb at found address
dis assemble again
loop with foreach where ps and pS are skip before and skip after bytes
A sample output of the above script:
0:000> .foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 }
msgbox!start+0x2 [msgbox.asm @ 17]:
00401002 6800304000 push offset msgbox!MsgCaption (00403000)
msgbox!start+0x2 [msgbox.asm @ 17]:
00401002 ebfe jmp msgbox!start+0x2 (00401002)
msgbox!start+0x7 [msgbox.asm @ 17]:
00401007 6819304000 push offset msgbox!MsgBoxText (00403019)
msgbox!start+0x7 [msgbox.asm @ 17]:
00401007 ebfe jmp msgbox!start+0x7 (00401007)
