Mastering Assembly Programming

Preparing for the patch

Unfortunately, we cannot simply redirect the call to fgets() instead of j_gets, because we do not have fgets() imported at all (as we are not using it in our C source) as well as due to the fact that gets() takes only one argument (as we see at the address 0x4117EB-cdecl passing of a parameter), while fgets() expects three. Trying to patch the code in place so that it would pass three parameters is not possible without damaging the executable and rendering it unusable. This means that we need to find a place for shim code, which would add the two additional parameters and actually call fgets() (once we add it as an imported function).

Fortunately for us, PE sections in memory (and, in fact, in files too) occupy much ...