3

After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to patch the binary.

But the problem is, when executing the module, ds:yyyy is not updated based on the module imagebase, and therefore an invalid address.

How can I deal with this kind of situation? Need I patch the reloc section too? Thanks.

2
  • 1
    Could you provide more information about the address yyyy ? Is it an address from another module, an address that changes everytime you launch the binary, or a static address ? – Spl3en Jun 20 '15 at 1:04
  • @Spl3en Thanks for reply. I have managed to solve this. It is an address that would be changed every time I launch it because of the ASLR and address relocation. I add a reloc record in relocation table and it runs well. – haohaolee Jun 22 '15 at 8:26
1

Answer it myself. It is actually a portable executable. And the addresses that are hard-coded will be updated every time I launch it by relocation table.

I modified the table by tools and it runs well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.