Help with Ghidra and rewriting assembly

Question

I'm learning reversing and for that I use Ghidra. There is program I'm trying to modify so I can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going inside the function I think to make it work I need to pass a zero. In the assembly I can read:

PUSH RBP
MOV RBP,RSP
MOV EDI,0x4
CALL function
MOV qword ptr [data],RAX

What I understand from that (and I'm propably wrong) is that the MOV EDI,0x4 is the 4 given in the function so I tried to rewrite it in Ghidra with 0x0 and it replace the:

bf 04 00 00 00 with bf 00 00 00 00

I thought it would be enough and I exported as an ELF but when I start the program I get a segmentation fault so I guess I'm doing something wrong with the memory.

    (gdb) x/10xi $rip
=> 0x555555401888:      mov    (%rax),%rax
   0x55555540188b:      test   %rax,%rax
   0x55555540188e:      jne    0x55555540189a
   0x555555401890:      mov    $0x0,%eax
   0x555555401895:      jmp    0x55555540199d
   0x55555540189a:      movq   $0x0,-0x50(%rbp)
   0x5555554018a2:      mov    -0x60(%rbp),%rax
   0x5555554018a6:      mov    %rax,%rdi
   0x5555554018a9:      call   0x5555554008f0 <strlen@plt>
   0x5555554018ae:      mov    %rax,-0x48(%rbp)

I would like some help to understand what I'm doing wrong.

thanks

Answer 1

You need to understand the consequences of patching an instruction. What gets changed by the instruction - both data and control flow. Based on the comments I think you are trying to patch this part

.text:0000000000000B4C                 push    rbp
.text:0000000000000B4D                 mov     rbp, rsp
.text:0000000000000B50                 mov     edi, 4
.text:0000000000000B55                 call    sub_1673

to

.text:0000000000000B4C                 push    rbp
.text:0000000000000B4D                 mov     rbp, rsp
.text:0000000000000B50                 mov     edi, 0
.text:0000000000000B55                 call    sub_1673

Based on this you can see what will change when sub_1673 gets executed.

...
.text:000000000000167C                 mov     [rbp+nmemb], rdi
.text:0000000000001680                 cmp     [rbp+nmemb], 0
.text:0000000000001685                 jnz     short loc_1691
.text:0000000000001687                 mov     eax, 0
.text:000000000000168C                 jmp     loc_1736
...
.text:0000000000001736                 add     rsp, 28h
.text:000000000000173A                 pop     rbx
.text:000000000000173B                 pop     rbp
.text:000000000000173C                 retn

Based on the calling convention 0 will be copied to rdi. It is then compared to 0 and then a jump is taken if its non zero. If its zero the function returns with a return value of zero. Something like

int sub_1673(size_t a1) {
    if(!a1) return 0;
    ....
}

If the value was non-zero some memory is allocated and the pointer is saved to some global variable. In your case - after the patch the variable stays 0 and the application crashes while read NULL(0) address.