Patch a Constant Value in a Binary

Topic Overview

Binary Patching

Binary patching modifies an executable file directly without recompiling from source. Crackme solvers, malware analysts, and hotfix engineers all patch bytes in place when they need to change program behavior quickly.

Finding and Applying a Patch

The workflow:

1. Disassemble the binary and find the target instruction
2. Note the file offset (not the virtual address)
3. Convert VA to file offset: offset = VA - section_VA + section_file_offset
4. Verify bytes at that offset match expected instruction encoding
5. Write new bytes and save

For example, changing a conditional jump from JNE (0x75) to JE (0x74) inverts a license check with a single-byte patch.

For This Exercise

You will search a simulated binary for a target byte pattern, show the offset where it was found, and replace it with new values. This teaches the VA-to-file-offset conversion that Ghidra and IDA automate when you edit instructions in the decompiler view.

Patch Safety and Relocation

Changing instruction length breaks PC-relative call and jmp targets in x86 code. Single-byte patches (like flipping a jump opcode) are safest because they preserve instruction boundaries. Signed binaries detect any byte change via hash verification, which is why operating systems enforce code signing on boot loaders and app store distributions. Always work on a copy and document the original bytes before patching.

Your Task

Patch an instruction in a binary safely: find the bytes, check that the patch keeps the instruction length, show where it lands in memory, and apply it.

1. Find the first occurrence of the pattern in the image.
2. Convert the match's file offset to a virtual address: VA = section_vaddr + (offset - section_offset).
3. Refuse a replacement of a different length. Changing an instruction's length shifts every byte after it.
4. If the pattern is mov eax, imm32 (5 bytes starting with B8), show the old and new immediates.
5. Apply the patch and dump the image.

Input

1. section_vaddr section_offset, both hex.
2. The image length M (1 to 4096), then M bytes in hex.
3. The pattern length P (1 to 64), then P bytes in hex.
4. The replacement length R (1 to 64), then R bytes in hex.

Output

cCopy
Loading…

Then:

• no match: Pattern not found, and stop.
• the match is before the section start: Error: match at 0x10 precedes section file offset 0x80, and stop.
• otherwise Found at file offset 0x83 (VA 0x401003), Old bytes: b8 1e 00 00 00 and New bytes: b8 3c 00 00 00 (lowercase), then
  • different lengths: Error: replacement length 2 != pattern length 5 (unsafe patch), and stop;
  • a 5-byte B8 pattern: mov imm32: 0x0000001E -> 0x0000003C (30 -> 60);
  • Patched binary: and the dump, 16 bytes per line, each line starting with the offset as 4 uppercase hex digits and a space, then the bytes in lowercase separated by spaces: 0080 55 89 e5 b8 3c 00 00 00 89 45 fc b8 00 00 00 00.

Offsets and addresses in these lines are uppercase hex.