Patch Segment

[dashne]

Hi everyone, Please can you help me with this code below, why the patch is not working, it says nothing when executing this code below:

/*
simply make  : IsSunccessful => true;  to IsSunccessful =>false;
*/
var shell =   @"path_to_the_assemblyl";
var pe = PEFile.FromFile(shell);
var ad = AssemblyDefinition.FromFile(pe);
var types = ad.Modules[0].GetAllTypes();
var f = types.FirstOrDefault(q => q.FullName.Equals("Application.Result"));
if (f != null)
{
    var m = f.Methods.FirstOrDefault(q => q.Name.Equals("IsSuccessful"));
    if (m != null)
    {        
        foreach (var i in m.CilMethodBody.Instructions)
        {
            if (i.OpCode.Code == CilCode.Ldc_I4_1)
            {
                var sec = pe.Sections.FirstOrDefault(q => q.Name.Equals(".text"));
                if (sec != null)
                {
                    var seg = sec.Contents.AsPatchedSegment();
                    var bb1 = CilCode.Ldc_I4_0.ToOpCode().Byte1;
                    var bb2 = CilCode.Ldc_I4_0.ToOpCode().Byte1;
                    var b1 = i.OpCode.Byte1;
                    var b2 = i.OpCode.Byte2;
                    var offset = (uint)(m.CilMethodBody.Address.Rva + i.Offset);
                    seg.Patch(offset, new[] { bb1, bb2 });                    
                    sec.Contents = seg;
                }
            }
        }
    }
}
pe.Write(@"new_path_to_Assembly");

Thanks.

[Washi1337]

A couple notes:

• The ldc.i4.0 and ldc.i4.1 both only consist of one byte. OpCode.Byte2 will thus have a meaningless value and should also not be written, or else you will be overwriting subsequent instructions.
• CIL method bodies have a header that is either 1 byte or 12 bytes, depending on whether it is a tiny or fat method body (see CilMethodBody::IsFat). You will need to add this to your instruction's final address.
• By using Address.Rva you are computing an RVA and not a file offset. Either convert the resulting RVA to a file offset using PEFile::RvaToFileOffset, or use Address.Offset instead.
• You don't need to write to a MemoryStream before assigning the new contents to the section.

[dashne]

please, can you correct my code for me,
and PatchedSegment.Patch first parameter comment says: it is relative Offset from start of segment!
Thanks.

[Washi1337]

Something in the lines of the following should do the trick:

// Compute method header size.
ulong headerSize = m.CilMethodBody.IsFat ? 12ul : 1ul;

// Determine file offset to patch.
ulong offset = m.CilMethodBody.Address.Offset + headerSize + (ulong) i.Offset;

// Patch section contents (Note: first param is relative to start of section contents).
sec.Contents = sec.Contents
    .AsPatchedSegment()
    .Patch((uint)(offset - sec.Offset), new[] { CilCode.Ldc_I4_0.ToOpCode().Byte1 });