0

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing:

BE E4732201      MOV ESI,App.012273E4

should be replaced by

E9 9C380000      JMP App.0104EC75

It's funny because it is anyway a relativ jump, where I literally want to jump 0x389C from execution pointer. Instructions have also same size so I suppose there is no problem with filling or alignment..? I've done other modifications in the HEX and haven't got a problem so far. But with this one, everytime it runs, it changes my 9C380000 literal to something like 9C38xx00 where "xx" varies depending on the execution or if running on Olly or IDA. Even funnier, the instruction right above my patch is:

E9 A1380000      JMP App.0104EC75

Which is the exactly the same jump, to the same location (there fore plus 0x05 on the offset) and this one works. It's original code and does not get changed at all during execution but my jump does. Same OP code and same destination. Any thoughts why that is?

Improve this question

2 Answers 2

Reset to default
0

As peter ferrie pointed out you have a relocation entry there
which can be inferred by the opcode and address const

BE E4732201 => mnem addr => mov esi, 012273e4

if the load address changed the 0122 (HIGH_LOW) part will change
according to the load address so your patch gets modified .

i statically rebased an image from its preferred ImageBase

enter image description here

after changing image base notice the relocation address starts from
0xxxxxaa while instruction address starts from 0xxxxxa9
notice original bytes in the second snap (relocation table entry)

image is from ghidra

enter image description here

Improve this answer
4
  • Which software are you using, that shows directly the relocation table in this separate window?
    – FELIPE_RIBAS
    Jan 17, 2022 at 14:47
  • image is from ghidra
    – blabb
    Jan 17, 2022 at 14:54
  • Thanks. And from what I understood from relocation table, it only makes sense to have entries relative to absolut addresses like a label oder string, right? It would not make sense to have an entry for a near jmp for example, which then has relative address fa argument.
    – FELIPE_RIBAS
    Jan 17, 2022 at 14:57
  • relocations are done for fixed address constants for example preferred address is 0x400000 string "my awesome string" is located at 0x402000 | mov ecx,0x402000 here if the base is relocated t0 0x600000 then this 0x402000 needs to be adjusted as 0x602000 so there will be an entry in relocation table
    – blabb
    Jan 17, 2022 at 17:30
1

There's an entry in the relocation table that is pointing to that location, so the value is being adjusted according to the load-address. To fix the problem, you'll have to find that entry and disable it. The simplest change is to make the entry empty so that it's skipped, as opposed to copying all following entries over this one and reducing the count.

Improve this answer
2
  • I did not know about this table. I looked for the PE Executables format and definitions but found many different references to relocation tables. For example one in the MS-DOS Header section and another one further on. Which one should I look for? Is it this .reloc section (base relocation table)? Is there an easy way to find it with olly?
    – FELIPE_RIBAS
    Jan 17, 2022 at 14:44
  • Yes, the .reloc section. However, you might find an easier path by choosing an instruction shortly after the relocated one, and replacing that instead.
    – peter ferrie
    Jan 21, 2022 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.