Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  patch code in priv section

Topic created on: November 16, 2009 16:44 CST by rou2a .

Hi there
I'm using ollydbg trying to patch a program, I had located the jumps that I need to change the problem is that thest are located in the priv section so whenever I change them I can't save the exe file
and when i search for them using hex editor i can't find them.
following is the memory map for the program

Memory map
Address    Size       Owner      Section    Contains      Type                 Access    Initial   Mapped as
00400000   00001000   program                 PE header     Imag 01001002        R         RWE
00401000   0005E000   program      .text      code          Imag 01001002        R         RWE
0045F000   00001000   program      .rdata     imports,expo  Imag 01001002        R         RWE
00460000   00030000   program      .data      data          Imag 01001002        R         RWE
00490000   00001000   program      .rsrc      resources     Imag 01001002        R         RWE
004A0000   00003000                                       Map  00041020        R E       R E
00560000   00002000                                       Map  00041020        R E       R E
00570000   00103000                                       Map  00041002        R         R
00680000   00074000                                       Map  00041020        R E       R E
00980000   0003F000                                       Priv 00021004        RW        RW
009C8000   0001E000                                       Priv 00021004        RW        RW
00A80000   00027000                                       Priv 00021020        R E       RWE
00AB0000   0002B000                                       Priv 00021020        R E       RWE
00AE0000   00005000                                       Priv 00021020        R E       RWE
00AF0000   00003000                                       Priv 00021020        R E       RWE
00B00000   00003000                                       Priv 00021020        R E       RWE
00B10000   00008000                                       Priv 00021004        RW        RW
00B20000   00008000                                       Priv 00021004        RW        RW
00C20000   00001000                                       Map  00041004        RW        RW
00C30000   00001000                                       Map  00041004        RW        RW
00C40000   00001000                                       Priv 00021004        RW        RW
00CC0000   00050000                                       Map  00041002        R         R
00D10000   00003000                                       Priv 00021004        RW        RW
00D50000   00003000                                       Priv 00021004        RW        RW
00D90000   00003000                                       Priv 00021004        RW        RW
00DD0000   00006000                                       Priv 00021020        R E       RWE
00DE0000   00006000                                       Priv 00021020        R E       RWE
00DF0000   00006000                                       Priv 00021020        R E       RWE
00E00000   0003D000                                       Priv 00021020        R E       RWE
00E40000   00008000                                       Priv 00021004        RW        RW
00E80000   00001000                                       Priv 00021004        RW        RW
00EC0000   00001000                                       Priv 00021004        RW        RW
00F00000   00001000                                       Priv 00021004        RW        RW


the segment I'm trying to modify is loacted at 00E000000.

so how can I edit and be able to save this.

thanks

  takerZ   November 25, 2009 04:46.33 CST
The code youve tried to search is in the allocated memory, so you wont find it statically in hex editor. The only thing you can do is to find out where this code came from. Eventually the system often allocates memory by same addresses so there is a non-zero probability that you find your code at address youve told above. So wait for the moment when memory will be allocated and set a breakpoint on  write to find the place the code is being written to this buffer. I have some pesimistic thoughts about this, cuz if the code written to that place is packed, it will be hard to modify it.

  ronnie291983     November 26, 2009 05:44.43 CST
use OLLY dump to dump the exe, it will dump run time image of the EXE, which will include the allocated memory as well

  takerZ   November 26, 2009 15:07.32 CST
If you do so, you have to get rid of the code wich creates the segment or the memory will defenitely not be allocated at this address and all the modification will be simply ignored. This is not much easier than modifying packed code. Still if you find the place where this segment is created, you can search for a cave to insert code which will dynamically apply your modifications.

  ronnie291983     November 27, 2009 00:46.57 CST
@takerz: yeah, it will take some work after this, setting OEP to appropriate location, code patching if required. Fixing data structures such as import tables, if the plan is to make the exe relocatable.

ur approcah might be easier.

  sade44     November 30, 2009 10:05.55 CST
do yew no a proxy or a unblocked somthin so i can get on myspace

Note: Registration is required to post to the forums.

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit