📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  patch code in priv section

Topic created on: November 16, 2009 16:44 CST by rou2a .

Hi there
I'm using ollydbg trying to patch a program, I had located the jumps that I need to change the problem is that thest are located in the priv section so whenever I change them I can't save the exe file
and when i search for them using hex editor i can't find them.
following is the memory map for the program

Memory map
Address    Size       Owner      Section    Contains      Type                 Access    Initial   Mapped as
00400000   00001000   program                 PE header     Imag 01001002        R         RWE
00401000   0005E000   program      .text      code          Imag 01001002        R         RWE
0045F000   00001000   program      .rdata     imports,expo  Imag 01001002        R         RWE
00460000   00030000   program      .data      data          Imag 01001002        R         RWE
00490000   00001000   program      .rsrc      resources     Imag 01001002        R         RWE
004A0000   00003000                                       Map  00041020        R E       R E
00560000   00002000                                       Map  00041020        R E       R E
00570000   00103000                                       Map  00041002        R         R
00680000   00074000                                       Map  00041020        R E       R E
00980000   0003F000                                       Priv 00021004        RW        RW
009C8000   0001E000                                       Priv 00021004        RW        RW
00A80000   00027000                                       Priv 00021020        R E       RWE
00AB0000   0002B000                                       Priv 00021020        R E       RWE
00AE0000   00005000                                       Priv 00021020        R E       RWE
00AF0000   00003000                                       Priv 00021020        R E       RWE
00B00000   00003000                                       Priv 00021020        R E       RWE
00B10000   00008000                                       Priv 00021004        RW        RW
00B20000   00008000                                       Priv 00021004        RW        RW
00C20000   00001000                                       Map  00041004        RW        RW
00C30000   00001000                                       Map  00041004        RW        RW
00C40000   00001000                                       Priv 00021004        RW        RW
00CC0000   00050000                                       Map  00041002        R         R
00D10000   00003000                                       Priv 00021004        RW        RW
00D50000   00003000                                       Priv 00021004        RW        RW
00D90000   00003000                                       Priv 00021004        RW        RW
00DD0000   00006000                                       Priv 00021020        R E       RWE
00DE0000   00006000                                       Priv 00021020        R E       RWE
00DF0000   00006000                                       Priv 00021020        R E       RWE
00E00000   0003D000                                       Priv 00021020        R E       RWE
00E40000   00008000                                       Priv 00021004        RW        RW
00E80000   00001000                                       Priv 00021004        RW        RW
00EC0000   00001000                                       Priv 00021004        RW        RW
00F00000   00001000                                       Priv 00021004        RW        RW


the segment I'm trying to modify is loacted at 00E000000.

so how can I edit and be able to save this.

thanks

  takerZ   November 25, 2009 04:46.33 CST
The code youve tried to search is in the allocated memory, so you wont find it statically in hex editor. The only thing you can do is to find out where this code came from. Eventually the system often allocates memory by same addresses so there is a non-zero probability that you find your code at address youve told above. So wait for the moment when memory will be allocated and set a breakpoint on  write to find the place the code is being written to this buffer. I have some pesimistic thoughts about this, cuz if the code written to that place is packed, it will be hard to modify it.

  ronnie291983     November 26, 2009 05:44.43 CST
use OLLY dump to dump the exe, it will dump run time image of the EXE, which will include the allocated memory as well

  takerZ   November 26, 2009 15:07.32 CST
If you do so, you have to get rid of the code wich creates the segment or the memory will defenitely not be allocated at this address and all the modification will be simply ignored. This is not much easier than modifying packed code. Still if you find the place where this segment is created, you can search for a cave to insert code which will dynamically apply your modifications.

  ronnie291983     November 27, 2009 00:46.57 CST
@takerz: yeah, it will take some work after this, setting OEP to appropriate location, code patching if required. Fixing data structures such as import tables, if the plan is to make the exe relocatable.

ur approcah might be easier.

  sade44     November 30, 2009 10:05.55 CST
do yew no a proxy or a unblocked somthin so i can get on myspace

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit