After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and executes.

Example, Replace EB 1C with E9 1C FD

Now, the question. I have to modify multiple locations and manually adjusting values is killing me. Can I do this with code.google.com/p/pefile from python, which I am assuming will help in adjusting? Or is there any other module I can use? Some sample code I can find?


1 Answer 1


It is not that easy, or it is rather error prone. If you are going to insert 3 bytes in place of 2 bytes, you would be better off if you do a trampoline: jump to some other place, do what you want, then jump back to the next instruction. By employing trampolining, you can also save the registers.

A small sample could be like this:

jmp SomePlace  <---destroy old bytes and insert an unconditional jump  
NextInst:      <----|_________________________  
 ..                                           |    
SomePlace:                                    |   
"dancing with wolves"                         |  
jmp NextInst <------- this will jump back to->|  

In the case, if you are interested in replacing two bytes with two bytes, then almost all hex editors have some form of search and replace functionality.

Or you can write a simple script in your favorite utility.

A simple windbg example script for replacing all the push XXXX 68 XXXXXX bytes to EB FE. This example is a prototype, you need to tweak it based on the pattern you get:

.foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } 

All what this does is search the disassembly for the pattern 68?? (blind search can alter unintended data, use with caution).

When it is found, it uses the address where it was found to replace the two bytes 68XX with EB FE.

It does this for all the bytes that are found in a given range. In addition to this, it also prints out the assembly prior to modification and after modification:

# 68??  pattern search command in windbg 
401000 l?0x20  start search from 0x401000 end at 401020 
u place l1 disassemble one instruction when pattern found
ew place feeb  write word 0xfeeb at found address  
dis assemble again
loop with foreach where ps and pS are skip before and skip after bytes 

A sample output of the above script:

0:000> .foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } 
msgbox!start+0x2 [msgbox.asm @ 17]:
00401002 6800304000      push    offset msgbox!MsgCaption (00403000)
msgbox!start+0x2 [msgbox.asm @ 17]:
00401002 ebfe            jmp     msgbox!start+0x2 (00401002)
msgbox!start+0x7 [msgbox.asm @ 17]:
00401007 6819304000      push    offset msgbox!MsgBoxText (00403019)
msgbox!start+0x7 [msgbox.asm @ 17]:
00401007 ebfe            jmp     msgbox!start+0x7 (00401007)
  • I understand the part of replacing equal number of bytes but Trampoline is probably what I am looking for then.
    – Zingaro
    Sep 14, 2013 at 8:53
  • there was an old utility called code snippet creator by iczelion which i remember was useful in adding masm snippets and was able to patch the exe (dont remember if it supported multiple patches or not give it a try and see if it solves your problem should be available in woodmann's tool repository
    – blabb
    Sep 15, 2013 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.