0

Assembly beginner here, please be gentle! I have the following x64 assembly procedure and would like to patch it to always return a 15 (type int).

0000000000005f2c         push       rbp
0000000000005f2d         mov        rbp, rsp
0000000000005f30         mov        eax, dword [ds:rdi+0x18c]
0000000000005f36         pop        rbp
0000000000005f37         ret

How do I do that? Many thanks in advance!

DavidD
  • 1,009
  • 1
  • 14
  • 29

1 Answers1

2

Change the code at 5F30 to mov eax, 15. Since that is just 5 bytes and you have 6, add a NOP for padding. Machine code bytes B8 0F 00 00 00 90.

If you want to patch a file, you will first have to find the proper offset of course.

Jester
  • 56,577
  • 4
  • 81
  • 125