二进制补丁技术
理解如何静态修改和修补二进制文件，以改变程序行为或绕过检查。
二进制补丁技术 是 CoddyKit 上的免费 Reverse Engineering & Binary Analysis Basics 课时。 这是第 3 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Reverse Engineering & Binary Analysis Basics 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
What is Binary Patching?
Binary patching is the art of modifying a compiled program's machine code directly, without access to its original source code. Think of it as making surgical changes to an executable file.
This technique is crucial in reverse engineering, allowing us to alter program behavior, fix bugs, or even bypass security checks.
Common Patching Uses
Why would you patch a binary?
- Bug Fixes: Apply urgent fixes without recompiling.
- Feature Mods: Change how a program works or unlock hidden features.
- Bypass Checks: Disable license validations or trial limitations.
- Localization: Change text strings for different languages.
Essential Patching Tools
To patch binaries, you'll primarily use two types of tools:
- Hex Editors: For direct byte-level modifications. They show the raw hexadecimal and ASCII data.
- Disassemblers: Like Ghidra or IDA Pro, to understand the assembly code and identify where to patch.
We'll focus on the concepts behind hex editing first.
Using a Hex Editor
A hex editor displays a file's content as hexadecimal (base-16) numbers. Each pair of hex digits represents one byte of data. It also often shows the ASCII representation.
You can navigate by address, search for specific byte sequences or text, and directly modify bytes. Your changes are saved back to the file.
Modify a String (Concept)
Programs often store messages or labels as simple strings of characters. These strings are represented as a sequence of bytes in the binary file.
By finding the byte sequence for a string in a hex editor, you can change it to display a different message when the program runs.
Simple String Program
Consider this simple C program. After compilation, the text "Hello CoddyKit!" will be stored somewhere in its executable as a sequence of ASCII bytes.
You could open the compiled binary in a hex editor, find these bytes, and change them to "Hello Patcher!" for example.
#include <stdio.h>
int main() {
char message[] = "Hello CoddyKit!";
printf("%s\n", message);
return 0;
}Disabling Code with NOPs
The NOP (No Operation) instruction is like a placeholder. It tells the CPU to do nothing and simply move to the next instruction.
If you want to disable an instruction or a small block of code without causing errors, you can replace its bytes with the NOP instruction's opcode (often 0x90 in x86/x64).
Altering Control Flow
Programs make decisions using conditional jump instructions (e.g., "jump if equal," "jump if not zero"). These determine the program's flow.
By changing a conditional jump to an unconditional jump (e.g., JMP), or vice-versa, you can force a program to always take a certain path, effectively bypassing checks or changing logic.
Bypassing a Check
Imagine a program checks if a variable is zero and exits if it is. The assembly might look like:
TEST EAX, EAXJE Exit_Func
If we want to prevent the exit, we could change JE (Jump if Equal) to JNE (Jump if Not Equal), or even replace JE Exit_Func with NOPs if Exit_Func is short.
Patching Technique Check
When attempting to disable a specific instruction or a very small block of code in a binary without altering the program's overall structure or causing crashes, which assembly instruction is most commonly used for this purpose?
Binary Patching Recap
In this lesson, we explored binary patching techniques. You learned:
- What binary patching is and its common applications.
- The role of hex editors and disassemblers.
- How to modify data (like strings) and logic (using NOPs and jumps).
Patching requires careful analysis but opens up powerful ways to interact with compiled software!
常见问题解答
「二进制补丁技术」课时是免费的吗？
是的 — 「二进制补丁技术」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Reverse Engineering & Binary Analysis Basics 课程的其余内容，请升级到 CoddyKit PRO。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
「二进制补丁技术」这节课中我会学到什么？
理解如何静态修改和修补二进制文件，以改变程序行为或绕过检查。 你通过在浏览器中直接运行的动手代码来练习 Reverse Engineering & Binary Analysis Basics，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Reverse Engineering & Binary Analysis Basics 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Reverse Engineering & Binary Analysis Basics 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 3 节课，共 4 节。
「二进制补丁技术」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Reverse Engineering & Binary Analysis Basics 课中编写并运行代码吗？
能。每节 Reverse Engineering & Binary Analysis Basics 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。