Preparing the patch
This is the easiest step as we hardly have to do anything here. We already have a working patch code and the only important difference from the Assembly point of view is where the code is going to be placed in memory. We will be adding a new section right at the end of the victim executable, thus the loading address for the code (the Virtual Address) is calculated by the summation of Virtual Address and Virtual Size of the currently last section and rounding it up to the nearest multiple of SectionAlignment, which, in our case, would be 0x1D000 + 0x43C = 0x1d43C, rounded up to 0x1e000. However, despite being called a virtual address, this value is in fact an offset from ImageBase, which is 0x400000, thus the real virtual ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access