当前位置:网站首页>Modify PE program entry point

Modify PE program entry point

2022-06-09 08:31:00 Tianwen_ Herbert555

Fixed base address - Easy to debug

 Insert picture description here

Modify entry point

Program usage x64dbg open , You can see that the program base address is 140000000
 Insert picture description here

The entry point of the program is 11023, So in memory , Program entry point = Base address + Offset =140000000+11023=140011023
 Insert picture description here
ctrl+G Locate the 140011023, Then find a blank space , Choose here 1400113B3, Modify the assembly code to jmp 0x140011023
 Insert picture description here

 Insert picture description here

Right click → Patch → Patch files , Save the file as project2.exe, Then change the program entry point to 00113B3
 Insert picture description here

Now run project2.exe, You can see that the entry point has arrived 1400113B3, Continuing to run will jump to the original entry point of the program 140011023, Then run normally
 Insert picture description here
 Insert picture description here

原网站

版权声明
本文为[Tianwen_ Herbert555]所创,转载请带上原文链接,感谢
https://yzsam.com/2022/160/202206090827290552.html