Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to patch Header content #59

Open
confile opened this issue Nov 13, 2018 · 0 comments
Open

Unable to patch Header content #59

confile opened this issue Nov 13, 2018 · 0 comments

Comments

@confile
Copy link

confile commented Nov 13, 2018

I want to patch the RVA of the entrypoint in a PE file. Here is an example:

malware-windows_10_pro_x64

It turn out that I cannot modify the content. Alway getting this error:

malware-windows_10_pro_x64

Here is which options I tried:

The initial autoanalysis has been finished.
Keypatch: attempting to modify "dd rva _mainCRTStartup" at 0x4000A8 to "dd rva 1a00h, rva 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1a00h, 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x001a"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x401a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1222h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1220h, 1220h"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant