4

I am working on the binary bomb labs and i just disarmed the bomb i am planning on solving it through a debugger and work start to work on my dynamic analysis skills or i.e debugging my real question is how to patch or modify assembly instructions in gdb?

4

As a GDB method has been presented, I will draw attention to other methods which are generally easier with other software to alter the program.

Hopper Disassembler (Linux, OS X)

Move the cursor to the instruction to be modified, and in the edit menu select either patch to NOP (i.e. nullify instruction) or 'assemble instruction' which accepts x86 and ARM instructions.

enter image description here

It inserts the appropriate operation codes, and takes care of any offset adjustments to ensure the insertions do not affect the rest of the program. You can then run the program as modified and debug, or produce a new executable (ELF, Macho-O, PE/COFF).

IDA Pro (Linux, Windows, OS X)

Enable the patching menu by editing the idagui.cfg (with an editor with elevated privileges):

DISPLAY_PATCH_SUBMENU    = YES          // Display the Edit,Patch submenu

Use the patching menu under Edit to insert raw operation codes. Note by default IDA only auto-assembles for the IBM PC; see the Intel or ARM manuals for opcodes. IDA can then produce a new executable but often it may not work, and instead you need to resort to producing a .dif.


Patchers

If you would like to create a patcher, I recommend dup2 patcher. Once you have your new executable, compare the old and new for differences in the raw hex, and then specify the changes that need to be made into the patcher creator. (Either it replaces something at a specific offset, or searches for a set of bytes and replaces those.)


Alternate Methods

Remember that manually editing the assembly instructions of a program is not the only way to alter control flow. Instead, you could use a DLL hook; see for example the InfoSec article here.

| improve this answer | |
  • is there a way with radare2 radare.org/r ? – ddddavidee Oct 28 '15 at 19:33
  • @ddddavidee At the time this was posted, I had hours of trouble installing radare2 and so I never tried it. It seems it's easier to install and get the GUI working now, so I'll give it a go. In principle, of course it should be able to do it, it's just a matter of how much may not be automated for you. – JamalS Oct 28 '15 at 20:47
  • Acutally Hopper way seems to be the faster and easier, but I would need the full version to be able to save the modified file... So I'm looking for alternatives... – ddddavidee Oct 28 '15 at 20:55
0

You can use the set command to enable writing to the executable's .text section:

set write on

And then you can use the set command again to set the actual memory

set {int}0xdeadc0de = 0×90909090

But keep in mind gdb doesn't have a built-in assembler so you'll need to know the bytes that you need to patch in ahead of time (via nasm or some other method). Depending on how complex what you're trying to do is it might be easier to just modify the necessary registers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.