3 ms·
Btw, I recently did my first patches with ghidra. Is there any way to avoid jumping into a code cave by shifting all the instructions up then updating any state
by derac 3mo ago
Btw, I recently did my first patches with ghidra. Is there any way to avoid jumping into a code cave by shifting all the instructions up then updating any statements referring to those memory locations? Seems like it should be simple enoigh in theory, but I didn't find an implementation on a cursory search. Could probably code up a plugin pretty easily.
- BobbyTables2 3mo agoHow can you be dead certain that all references are known in Ghidra? Just non-disassembled function or unidentified struct would ruin your plans…
- ACCount37 3mo agoIt's basically re-linking the executable. Way too easy to shoot foot - miss one reference and things break in a spectacular, or, worse, subtle fashion. Which means: you definitely need to know where all the references are and what they point to. References are under no obligation to be presented in a sensible, decompiler-friendly way. Which is why "jump out into the patch, jump back in" is such a staple of patching. The other way is the hard way, full of pitfalls and potential issues.
- derac 3mo agoThanks for this explanation!