เทคนิคการแพตช์ไบนารี

Binary patching is the art of modifying a compiled program's machine code directly, without access to its original source code. Think of it as making surgical changes to an executable file.

This technique is crucial in reverse engineering, allowing us to alter program behavior, fix bugs, or even bypass security checks.

Why would you patch a binary?

• Bug Fixes: Apply urgent fixes without recompiling.
• Feature Mods: Change how a program works or unlock hidden features.
• Bypass Checks: Disable license validations or trial limitations.
• Localization: Change text strings for different languages.

To patch binaries, you'll primarily use two types of tools:

• Hex Editors: For direct byte-level modifications. They show the raw hexadecimal and ASCII data.
• Disassemblers: Like Ghidra or IDA Pro, to understand the assembly code and identify where to patch.

We'll focus on the concepts behind hex editing first.

A hex editor displays a file's content as hexadecimal (base-16) numbers. Each pair of hex digits represents one byte of data. It also often shows the ASCII representation.

You can navigate by address, search for specific byte sequences or text, and directly modify bytes. Your changes are saved back to the file.

Programs often store messages or labels as simple strings of characters. These strings are represented as a sequence of bytes in the binary file.

By finding the byte sequence for a string in a hex editor, you can change it to display a different message when the program runs.

Consider this simple C program. After compilation, the text "Hello CoddyKit!" will be stored somewhere in its executable as a sequence of ASCII bytes.

You could open the compiled binary in a hex editor, find these bytes, and change them to "Hello Patcher!" for example.

The NOP (No Operation) instruction is like a placeholder. It tells the CPU to do nothing and simply move to the next instruction.

If you want to disable an instruction or a small block of code without causing errors, you can replace its bytes with the NOP instruction's opcode (often 0x90 in x86/x64).

Programs make decisions using conditional jump instructions (e.g., "jump if equal," "jump if not zero"). These determine the program's flow.

By changing a conditional jump to an unconditional jump (e.g., JMP), or vice-versa, you can force a program to always take a certain path, effectively bypassing checks or changing logic.

Imagine a program checks if a variable is zero and exits if it is. The assembly might look like:

TEST EAX, EAX
JE Exit_Func

If we want to prevent the exit, we could change JE (Jump if Equal) to JNE (Jump if Not Equal), or even replace JE Exit_Func with NOPs if Exit_Func is short.

When attempting to disable a specific instruction or a very small block of code in a binary without altering the program's overall structure or causing crashes, which assembly instruction is most commonly used for this purpose?

In this lesson, we explored binary patching techniques. You learned:

• What binary patching is and its common applications.
• The role of hex editors and disassemblers.
• How to modify data (like strings) and logic (using NOPs and jumps).

Patching requires careful analysis but opens up powerful ways to interact with compiled software!