Log in

View Full Version : [x86] is it possible to reference memory with a different segment base?


Dzeimis
08-24-2011, 10:00 AM
Hello, I'm attempting to modify an existing executable without it's source code and I want a function from one segment to load some data from another segment (The data can't reside in the same segment as the code, because there's not enough code cave in that segment). However whenever I try to access the data I get an access violation error 0xC0000005.

kao
08-24-2011, 10:12 AM
Forget about segments and segment bases. In 32/64 bit windows you operate with virtual memory and pages, every memory page can have different memory protection options. See VirtualProtect() documentation in MSDN (http://msdn.microsoft.com/en-us/library/aa366898(v=vs.85).aspx).

Dzeimis
08-24-2011, 01:16 PM
I think I got it: I should write a DLL that changes protection for that page, right? Thanks for pointing me in the right direction.

kao
08-24-2011, 03:37 PM
I think I got it: I should write a DLL that changes protection for that page, right?
Not really, no. :) What I meant is - you can use your codecave to call VirtualProtect and make the necessary memory region writable.

Dzeimis
08-24-2011, 03:58 PM
I made it with DLL - this application automatically loads all *.dll and *.bin (memory patch) files from it's plugins directory, so no modification of original exe is required. Of course my solution might not be the best one, but I like learning things myself and anyway, it works (although the modification that I want to do isn't finished yet)