Suppose you have something like this (in x86-like asm)
10 | mov ebx 1 // good response from function "check" below
20 | call check() // modifies eax
30 | test eax ebx
40 | jeq good
50 | bad: call lose()
60 | jmp finish
70 | good: call win()
80 | finish: push/pop stuff from stack
90 | retn 0
Suppose I want to modify the logic so that it always executes some win()
. From what we have, there are multiple ways to accomplish this. Here are strategies I can see:
- NOP 10-60 (but then maybe important registers/stack are not set because
check()
isn't called as well as registers/stack may not be set properly) - 30 - make it
test eax eax
or something along these lines. Seems like a solid way, but isn't it then better to do (3) - 40 - make jump unconditional. This is what I do currently, but I wonder if the CPU overhead (for things like
30 | test eax ebx
are acceptable) - 50 or 60 - make either perform
jmp good
-- seems like the destructive/potentially crash inducing approach due to registers/stack being already pre-set for lose() function - Create a ROP chain/inject my own logic to just call win() -- isn't it too much for this situation?
- modify
10 | mov ebx 1
to be set to0
-- but then in casewin()
should be called, it won't be
I wonder if there is a standard strategy recommended for patching like this.