btb33
April 17th, 2010, 11:27
I've read the FAQs and think I've come quite a long way, but I'm stuck and would appreciate a pointer in the right direction.
I'm patching a file, it's a dll that runs under WinCE, with a SH-4 processor. So far I've found the only program that will dissemble it IDA, buts that's OK, and I've got it loaded up and I've made the change, now I want to save my change.
I know IDA doesn't re-assemble, so I've tried OllyDBG but it won't load my WinCE dll. I think the only way I can patch this file now is to change the HEX code, I've tried to work out how to make the change using a HEX editor, but can't figure it out. I know the offset and I can find the original HEX code for that location, but how do I get the new HEX code?
The line I have in IDA is for example like this:
and I want to change it to say this, just a one digit change:
The HEX code for the original line is "11 D4 0B D0 02 63 0B 43 09 00 10 D2 22 61 0B 41" I've spent hours trying to work out how to get the HEX code for the alteration. I've come to the conclusion I must be missing something, but I'm going round in circles now.
Is there a way for me find the new HEX code?
I've also tried to produce a diff file, but when I do its empty, just the identifier and file name.
I'm patching a file, it's a dll that runs under WinCE, with a SH-4 processor. So far I've found the only program that will dissemble it IDA, buts that's OK, and I've got it loaded up and I've made the change, now I want to save my change.
I know IDA doesn't re-assemble, so I've tried OllyDBG but it won't load my WinCE dll. I think the only way I can patch this file now is to change the HEX code, I've tried to work out how to make the change using a HEX editor, but can't figure it out. I know the offset and I can find the original HEX code for that location, but how do I get the new HEX code?
The line I have in IDA is for example like this:
Code:
text54:03263860 mov.l off_32638A8, r4
and I want to change it to say this, just a one digit change:
Code:
text54:03263860 mov.l off_3263898, r4
The HEX code for the original line is "11 D4 0B D0 02 63 0B 43 09 00 10 D2 22 61 0B 41" I've spent hours trying to work out how to get the HEX code for the alteration. I've come to the conclusion I must be missing something, but I'm going round in circles now.
Is there a way for me find the new HEX code?
I've also tried to produce a diff file, but when I do its empty, just the identifier and file name.