When patching static software, is there a preferred patching strategy?

Question

Suppose you have something like this (in x86-like asm)

10 | mov ebx 1 // good response from function "check" below
20 | call check() // modifies eax
30 | test eax ebx
40 | jeq good
50 | bad:   call lose()
60 | jmp finish
70 | good:  call win()
80 | finish:    push/pop stuff from stack
90 | retn 0

Suppose I want to modify the logic so that it always executes some win(). From what we have, there are multiple ways to accomplish this. Here are strategies I can see:

1. NOP 10-60 (but then maybe important registers/stack are not set because check() isn't called as well as registers/stack may not be set properly)
2. 30 - make it test eax eax or something along these lines. Seems like a solid way, but isn't it then better to do (3)
3. 40 - make jump unconditional. This is what I do currently, but I wonder if the CPU overhead (for things like 30 | test eax ebx are acceptable)
4. 50 or 60 - make either perform jmp good -- seems like the destructive/potentially crash inducing approach due to registers/stack being already pre-set for lose() function
5. Create a ROP chain/inject my own logic to just call win() -- isn't it too much for this situation?
6. modify 10 | mov ebx 1 to be set to 0 -- but then in case win() should be called, it won't be

I wonder if there is a standard strategy recommended for patching like this.

Answer 1

The better solution (on my opinion) is

1. the simpler,
2. less influencing other program logic,
3. provides length equality of opcodes you want to replace and those you want to insert.

By my experience the less painful way is to switch conditional jump (je) to unconditional jmp, as opcodes are always the same length (74 0a vs eb 0a):

;addr  opcode                  instruction
0:     bb 01 00 00 00          mov    ebx,0x1
5:     e8 00 00 00 00          call   sub_check
a:     85 d8                   test   eax,ebx
c:     74 0a                   je     18 <good>
000000000000000e <bad>:
e:     e8 00 00 00 00          call   sub_lose
13:    e9 00 00 00 00          jmp    18 <good>
0000000000000018 <good>:
18:    e8 00 00 00 00          call   sub_win

and

;addr  opcode               instruction
0:     bb 01 00 00 00       mov    ebx,0x1
5:     e8 00 00 00 00       call   sub_check
a:     85 d8                test   eax,ebx
c:     eb 0a                jmp    18 <good>
000000000000000e <bad>:
e:     e8 00 00 00 00       call   sub_lose
13:    e9 00 00 00 00       jmp    18 <good>
0000000000000018 <good>:
18:    e8 00 00 00 00       call   sub_win