symbols - Dave's Blog

Search
My timeline on Mastodon

Cdb/Windbg Commands for Runtime Patching

2016 Feb 8, 1:47

You can use conditional breakpoints and debugging commands in windbg and cdb that together can amount to effectively patching a binary at runtime. This can be useful if you have symbols but you can't easily rebuild the binary. Or if the patch is small and the binary requires a great deal of time to rebuild.

Skipping code

If you want to skip a chunk of code you can set a breakpoint at the start address of the code to skip and set the breakpoint's command to change the instruction pointer register to point to the address at the end of the code to skip and go. Voila you're skipping over that code now. For example:

bp 0x6dd6879b "r @eip=0x6dd687c3 ; g"

Changing parameters

You may want to modify parameters or variables and this is simple of course. In the following example a conditional breakpoint ANDs out a bit from dwFlags. Now when we run its as if no one is passing in that flag.

bp wiwi!RelativeCrack "?? dwFlags &= 0xFDFFFFFF;g"

Slightly more difficult is to modify string values. If the new string length is the same size or smaller than the previous, you may be able to modify the string value in place. But if the string is longer or the string memory isn't writable, you'll need a new chunk of memory into which to write your new string. You can use .dvalloc to allocate some memory and ezu to write a string into the newly allocated memory. In the following example I then overwrite the register containing the parameter I want to modify:

.dvalloc 100
ezu 000002a9`d4eb0000 "mfcore.dll"
r rcx = 000002a9`d4eb0000

Calling functions

You can also use .call to actually make new calls to methods or functions. Read more about that on the Old New Thing: Stupid debugger tricks: Calling functions and methods. Again, all of this can be used in a breakpoint command to effectively patch a binary.

PermalinkCommentscdb debug technical windbg

Retweet of FakeUnicode

2016 Jan 24, 10:52
.@alolita How Ancient Egypt fell. "But great Pharaoh, we need a snake playing croquet." "You have like 50 snake symbols." "But, croquet!"
PermalinkComments

Encode-O-Matic Update: Compression, Hex View, Quick Show Output

2010 Mar 9, 9:08

I've just put up an update for Encode-O-Matic with the following improvements:

PermalinkCommentstechnical encodeomatic project

Symbols.com - Home

2007 Sep 4, 1:53Database of symbols and their meaning.PermalinkCommentsbook purchase reference symbols language dictionary index database free encyclopedia

Intel Assembly Quick Reference

2006 Aug 31, 7:25Debugging assembly isn't that bad... Although source+symbols is much nicer.PermalinkCommentsintel x86 assembly programming reference

Debugging Tools and Symbols: Getting Started

2006 Mar 9, 9:53PermalinkCommentsmicrosoft windows decompiler debug debugger x64 x86
Older Entries Creative Commons License Some rights reserved.