1

I'm trying a code-cave approach to this query that was asked about on this forum earlier.

I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of assembly within the code-cave, using Right-Click > Patches does not apply them.

Does x64_dbg require an additional add-on to perform this kind of patching? However, the code changes inside the address space of the function patches just fine.

Assembly code (Code-Cave)

enter image description here

Failed dialog box

enter image description here

  • Where did you place the code cave? If you put it at the end of the other code, it might be beyond the end of the segment, which would explain why windbg can't write it back. – Guntram Blohm supports Monica Jul 17 '15 at 13:26
  • I scrolled all the way to the bottom of the window and wrote it there. – Pramod Mohandas Jul 17 '15 at 14:04
  • Unfortunately this did not work me. I tried patching the virtual sizes of all the section headers and it didn't make any difference... – Migs Sep 8 '19 at 19:47
2

x64_dbg uses TitanEngine's ConvertVAtoFileOffsetEx() function to apply the patches. That function validates that the virtual addresses of the bytes to be patched are within a section's memory space at run-time (based on the section's virtual address and the section's virtual size). Since the bytes you're patching are after the end of the section's virtual size, ConvertVAtoFileOffsetEx() returns 0 and the patches are never applied.

As a workaround, I'd recommend patching the virtual size of the section to which you're appending those new bytes. Whatever the current virtual size is, make it 14 bytes bigger in the PE section's header.

You can use a tool like Explorer Suite to make this change by navigating to the file's Section Headers and increasing the value in the target section's Virtual Size field:

Explorer Suite

| improve this answer | |
  • Could you kindly also reference a few links on a how-to for patching the virtual size of the section header in your answer ? – Pramod Mohandas Jul 17 '15 at 14:59
  • I've updated my answer above with a link and instructions. – Jason Geffner Jul 17 '15 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.