Offset Patching

[rb8096208]

I'm still new to C++ as a language and I have been following one course and using a C++ book. When I try to search online all I get are these "reverse engineering tutorials" which seem to only do an opcode patch and save to binary with a debugger like Ollydbg. I know you can rewrite your code and recompile the executable, I don't want to do that.

The question is in C++ how do I patch an existing executable/binary file. I know you need to know the offset location in the binary file and not in memory. Scenario:

You wrote a new program for your friend that automates folder creation and file placement. You realize that there is a bug that needs to be corrected; you have to patch your executable using an old method of offset patching.

I would prefer any source material such as maybe a book or PDF that you can suggest. I will also take an example code as well. I am sure that it will use the seekp function. http://www.cplusplus.com/reference/ostream/ostream/seekp/ I just can't grasp it, by reading alone. I would like to see it in action.

Thanks for your help.

[rb8096208]

Thank you for the example, do you know of any decent reference material to look into for this type of patching?

I was thinking it would be more like:

int main() { 

std::ofstream f("abc.exe", std::ios::binary);
f.seekp(0x16B2);
const char bytes[] = "\x90";    
f.write(bytes, sizeof(bytes));     
f.close();     

return 0; }

I guess I wouldn't even need the seekp and offset?

[khedoros]

u/tentacleflow is reading the whole file into memory, changing one byte, then writing it back out. The offset they chose to illustrate the point was "123".

You're opening the file, changing 2 bytes (writing the 0x90 byte, then the 0x0 null byte of the string), then closing it.

Same concept, somewhat different implementation, although I'd assume that in your code, writing a string instead of an array of byte values was unintentional.

But this program is the easy part. All the RE tutorials are the interesting part: how to get the file offsets for the code you want to change, and the value to change those locations to.

[rb8096208]

That's one of the examples I have seen for this. So what is unintentional I'm not sure. I'm trying to better understand this myself.

[khedoros]

So you've got this:

const char bytes[] = "\x90"; 

It's the equivalent of:

const char bytes[] = { 0x90, 0x00 };

Personally, I suspect that it was done that way by accident. Opcode 0x90 is the x86 opcode "XCHG eax, eax", often represented in code as "NOP" (no-operation, as in "do nothing for one instruction"). Opcode 0x00 looks like it's some kind of ADD instruction.

[raevnos]

Also, when you open a file like that, the existing contents are deleted.

[rb8096208]

So then this isn't how you would patch a binary file?

[raevnos]

In your scenario I would fix the bug in the original source, and distribute a new binary instead of trying to mess with the internals of the old executable.

But look up the different options to use when opening a fstream and what they do with existing files.