search

keystone-engine / keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
http://www.keystone-engine.org/keypatch
GNU General Public License v2.0
1.47k stars 355 forks source link

Unable to patch Header content #59

Open confile opened 5 years ago

confile commented 5 years ago

I want to patch the RVA of the entrypoint in a PE file. Here is an example:

malware-windows_10_pro_x64

It turn out that I cannot modify the content. Alway getting this error:

malware-windows_10_pro_x64

Here is which options I tried: 

The initial autoanalysis has been finished.
Keypatch: attempting to modify "dd rva _mainCRTStartup" at 0x4000A8 to "dd rva 1a00h, rva 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1a00h, 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x001a"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x401a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1222h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1220h, 1220h"