Hi there
I'm using ollydbg trying to patch a program, I had located the jumps that I need to change the problem is that thest are located in the priv section so whenever I change them I can't save the exe file
and when i search for them using hex editor i can't find them.
following is the memory map for the program
Memory map
Address Size Owner Section Contains Type Access Initial Mapped as
00400000 00001000 program PE header Imag 01001002 R RWE
00401000 0005E000 program .text code Imag 01001002 R RWE
0045F000 00001000 program .rdata imports,expo Imag 01001002 R RWE
00460000 00030000 program .data data Imag 01001002 R RWE
00490000 00001000 program .rsrc resources Imag 01001002 R RWE
004A0000 00003000 Map 00041020 R E R E
00560000 00002000 Map 00041020 R E R E
00570000 00103000 Map 00041002 R R
00680000 00074000 Map 00041020 R E R E
00980000 0003F000 Priv 00021004 RW RW
009C8000 0001E000 Priv 00021004 RW RW
00A80000 00027000 Priv 00021020 R E RWE
00AB0000 0002B000 Priv 00021020 R E RWE
00AE0000 00005000 Priv 00021020 R E RWE
00AF0000 00003000 Priv 00021020 R E RWE
00B00000 00003000 Priv 00021020 R E RWE
00B10000 00008000 Priv 00021004 RW RW
00B20000 00008000 Priv 00021004 RW RW
00C20000 00001000 Map 00041004 RW RW
00C30000 00001000 Map 00041004 RW RW
00C40000 00001000 Priv 00021004 RW RW
00CC0000 00050000 Map 00041002 R R
00D10000 00003000 Priv 00021004 RW RW
00D50000 00003000 Priv 00021004 RW RW
00D90000 00003000 Priv 00021004 RW RW
00DD0000 00006000 Priv 00021020 R E RWE
00DE0000 00006000 Priv 00021020 R E RWE
00DF0000 00006000 Priv 00021020 R E RWE
00E00000 0003D000 Priv 00021020 R E RWE
00E40000 00008000 Priv 00021004 RW RW
00E80000 00001000 Priv 00021004 RW RW
00EC0000 00001000 Priv 00021004 RW RW
00F00000 00001000 Priv 00021004 RW RW
the segment I'm trying to modify is loacted at 00E000000.
so how can I edit and be able to save this.
thanks





