1

I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that "The memory could not be written" and the procedure is aborted.

I'm sure I've enabled the patch. But I can see in runtime that Hex View shows that memory of the address in the new seg that I jump to remains "00 00 00 00 ..."(Not my codes added).

So, how can I figure it out? Or maybe there's no solution cuz I've googled this problem for nearly 6hrs. Only one question relates to it, and the solution is using another debugger, but I want to add a new seg into the binary file.enter image description here

4
  • Are you trying to write to the new segment or execute instructions there? When you create it, you will mark it (RWX) according to how you want to use it. Nov 12 at 3:52
  • @MegaTonnage I’ve marked it R and X, but when the program runs to the address of the new segment, it fails cuz the memory is unreachable. Nov 12 at 4:09
  • The error message you posted says that there is an instruction at 0x96D001 trying to write to that segment, but it can't if it's RX. Should it be writing to it? Nov 12 at 10:04
  • @MegaTonnage I have tested RWX, but it didn't work. I don't think it should be W, cuz I want my codes to be executed instead of to be modified during runtime. I tried to use PE editor to rewrite PE header and it was successful to edit the PE image size. But it seems that adding segs is not allowed (output: win10 cannot open file edited). Nov 12 at 11:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.