Learning Malware Analysis

2.10 Patching in x64dbg

While performing malware analysis, you may want to modify the binary to change its functionality or reverse its logic to suit your needs. x64dbg allows you to modify data in the memory or instructions of a program. To modify the data in a memory, navigate to the memory address and select the sequence of bytes you want to modify, then right-click and choose Binary | Edit (Ctrl + E), which will bring up a dialog (shown as follows) that you can use to modify the data as ASCII, UNICODE, or a sequence of hex bytes:

The following screenshot shows the code excerpt from the TDSS rootkit DLL (this is the same binary that was ...