Patching jmp instructions on amd64 with IDA

Question

For experimentation, while waiting for vendor to fix bug, wanted to try and eliminate a crash that occurs on occasion. Up till now I've only done patching replacing existing code, not trying to insert additional code.

Original

.text:000000018000A260                 cmp     [rax], r12d <- RAX=0, crashes program
.text:000000018000A263                 jz      short loc_18000A271
.text:000000018000A265                 cmp     dword ptr [rax], 6
.text:000000018000A268                 jnz     short loc_18000A276
.text:000000018000A26A                 cmp     ecx, 40h

And further on:

.text:000000018000A21B                 mov     rcx, [rsp+388h+var_350]
.text:000000018000A220                 call    cs:WindowsDeleteString
.text:000000018000A226                 mov     [rsp+388h+var_350], r15
.text:000000018000A22B                 mov     rbx, [rsp+388h+var_348]

I want to insert some new instruction, changing to jmp to patched code

.text:000000018000A260                 jmp     <patched code>

Patched Code Idea - I can't find much suitable place to insert code - so was thinking of shortening some non-essential strings in .rdata section to insert this code - Is there any issue with this? Essentially what I am trying to do is if RAX = 0 , skip over the use of [rax]

cmp rax,0
jz .text:000000018000A21B ; The code point past using [rax]
cmp [rax], r12d
jmp .text:000000018000A263 ; Continue program execution normally

Now it seems IDA "Assemble" doesn't always work, for example cmp rax,0 it says "Invalid Operand" So I had to patch bytes instead

48 83 F8 00 = cmp rax,0

Is there a way to get the "assemble" in IDA to reference my jump locations, using the location references in IDA. Or is there a suggested method to calculate how to build my jmp/jz instructions.

Answer 1

Patched Code Idea - I can't find much suitable place to insert code - so was thinking of shortening some non-essential strings in .rdata section to insert this code - Is there any issue with this?

You should not use the .rdata section as it's usually not not marked for execution of code. If you ignore this you will trigger DEP and changing the segment to allow code executions is obviously not recommended as well.

I would suggest to add a segment, extend the current segment or find some empty space in the current segment (maybe there's align bytes at the end).

Is there a way to get the "assemble" in IDA to reference my jump locations, using the location references in IDA. Or is there a suggested method to calculate how to build my jmp/jz instructions.

You can just take the difference between the two virtual addresses and use a relative jump (0xE9).

Now it seems IDA "Assemble" doesn't always work, for example cmp rax,0 it says "Invalid Operand"

This feature is not supported for AMD64 according to Hex Rays:

The assembler command is supported for only a few processors, only a few instructions. We do not plan to extend this feature, sorry