I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing:
BE E4732201 MOV ESI,App.012273E4
should be replaced by
E9 9C380000 JMP App.0104EC75
It's funny because it is anyway a relativ jump, where I literally want to jump 0x389C from execution pointer. Instructions have also same size so I suppose there is no problem with filling or alignment..? I've done other modifications in the HEX and haven't got a problem so far. But with this one, everytime it runs, it changes my 9C380000 literal to something like 9C38xx00 where "xx" varies depending on the execution or if running on Olly or IDA. Even funnier, the instruction right above my patch is:
E9 A1380000 JMP App.0104EC75
Which is the exactly the same jump, to the same location (there fore plus 0x05 on the offset) and this one works. It's original code and does not get changed at all during execution but my jump does. Same OP code and same destination. Any thoughts why that is?