📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  [HELP] Patching an binary file directly into memory

Topic created on: January 18, 2009 11:57 CST by HotBreeze .

Hi. I got a PE Packed binary [that have other binary and a DLL in it]. I need to patch some offsets of the DLL, but I can't actually unpack the file and/or change directly on the executable, or I get an error on the main proccess [it fail at checksum and quit immediatelly]. The workaround I made for this program is pathcing it directly at memory, after ran the main executable. I got the patch working, but I have to do it manually.

My question is: Can I make a custom "loader" to patch the binary at memory?

There's any tutorial/topic that can help me with this work?

Thanks to all =]

  Soul12     January 18, 2009 14:00.08 CST
http://www.reverse-engineering.info/PE_Information/Crackers_Guide_To_Program_Flow.pdf -> is a Excelent introduction to these matters .. give it a read

  lallous     January 19, 2009 05:12.20 CST
Write a small program (the loader) that CreateProcess() with SUSPENDED flag your program to be patched, then use WriteProcessMemory() to patch at desired offsets

  dimaky     January 20, 2009 09:48.26 CST
I'd use pydbg for that kind of task. You just need to do something like that:

import pydbg

dbg = pydbg.pydbg()
dbg.load(<your pe file>)
dbg.write(<addr>, <data>)

dbg.detach()

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit