I'm doing binary modifications to an old game to make it run in widescreen modes, among other things. At first I did the patching using OllyDbg, but when the changes became complex enough to make that infeasible I looked for a better tool and found a way to do it with NASM.
Since it has worked quite well for me I'll describe it here. (Of course, if you know of a better solution, please post.) The code provided is in a 'works for me' state, and the usual disclaimers apply.
This is how it works:
- Use e.g. OllyDbg to identify the absolute addresses (in virtual address space) where modifications must be made
- Use a tool (provided below) to generate an exe-specific include file
- In the top level asm file, use a couple of macros to move in virtual address space
- Write code and insert data as usual
- Run NASM on the top level asm file. The output will be a modified but valid binary
Here's the source for a small command line tool, which can be run on an exe file to produce an include file containing the following:
- Information from the exe's PE header about the various sections it contains
- Section definitions with the vstart attribute properly set
- Macros to advance the assembly position in the virtual address space
// geninc: generate a nasm include file containing information about a win32 exe pe header,
// and macros to facilitate binary patching of that exe using nasm.
//
// takes the exe filename as the only argument. the include file is placed in the
// same directory, and its name is derived from the exe name
//
// compiled using vs2008. this code is in the public domain
#include "stdafx.h"
#include <windows.h>
#include <iostream>
#include <iomanip>
#include <fstream>
#include <string>
#include <sstream>
#include <vector>
using namespace std;
// bump micro for bugfixes etc
// bump minor if generated incs are backwards compatible with existing including files,
// bump major if not
const string app_version = "0.0.6";
const int lbl_col_width = 16;
const int inst_col_width = 12;
const int op_col_width = 32;
const string inc_ext = "_pe.inc";
struct Section_hdr {
int number;
string name;
DWORD virt_size;
DWORD virt_addr;
DWORD raw_size;
DWORD raw_offs;
};
void return_err(const string& msg, int r)
{
cerr << "error: " << msg << endl;
exit(r);
}
void remove_ext(string& s)
{
int last = s.find_last_of('.');
if (last != s.npos) {
s = s.substr(0, last);
}
}
void remove_path(string& s)
{
int last = s.find_last_of("/\\");
if (last != s.npos) {
s = s.substr(last + 1);
}
}
void get_cur_dir(string& dir)
{
TCHAR cur_dir[MAX_PATH];
if (GetCurrentDirectory(MAX_PATH, cur_dir) == 0) return_err("couldn't get current directory", 1);
// this needs unicode disabled...
dir = cur_dir;
}
void tolower(string& s)
{
for (int pos = 0; pos < s.length(); ++pos) {
s[pos] = tolower(s[pos]);
}
}
void remove_special_chars(string& s)
{
// replace non-alphanum chars with underscores.
for (int i = 0; i < s.length(); ++i) {
if (! isalnum(s[i])) {
s[i] = '_';
}
}
// remove leading and trailing underscores
int first = s.find_first_not_of('_');
if (first == s.npos) {
s = "";
}
else {
int last = s.find_last_not_of('_');
s = s.substr(first, last - first + 1);
}
// remove consecutive underscores
for (int i = s.length() - 2; i > 0; --i) {
if (s[i] == '_' && s[i + 1] == '_') {
s.erase(i, 1);
}
}
}
void make_inc_nm(const string& exe, string& inc)
{
get_cur_dir(inc);
string name = exe;
remove_path(name);
remove_ext(name);
tolower(name);
remove_special_chars(name);
if (name == "") return_err("illegal filename", 1);
inc.append('\\' + name + inc_ext);
}
void make_inc_guard(const string& exe, string& gd)
{
gd = exe;
remove_ext(gd);
remove_path(gd);
gd.append(inc_ext);
remove_special_chars(gd);
tolower(gd);
}
void write_top(ofstream& ofs, const string& nm, DWORD base)
{
string guard;
make_inc_guard(nm, guard);
ofs << "; generated using version " << app_version << endl;
ofs << endl;
ofs << "%ifndef " << guard << endl;
ofs << "%define " << guard << endl;
ofs << endl;
ofs << "%ifndef ptarget" << endl;
ofs << " %define ptarget " << '"' << nm << '"' << endl;
ofs << "%endif" << endl;
ofs << endl;
ofs << setw(lbl_col_width) << "imagebase" << setw(inst_col_width) << "equ" << '0' << base << 'h' << endl;
ofs << endl;
}
void write_section_info(ofstream& ofs, Section_hdr& sect)
{
string prefix = sect.name;
remove_special_chars(prefix);
tolower(prefix);
// in case a section name was all non-alphanum chars
if (prefix == "") {
stringstream ss;
ss << "sect" << sect.number;
prefix = ss.str();
}
ofs << "; " << sect.name << endl;
ofs << setw(lbl_col_width) << "virt." + prefix << setw(inst_col_width) << "equ" << "imagebase";
if (sect.virt_addr > 0) {
ofs << " + 0" << sect.virt_addr << 'h';
}
ofs << endl;
ofs << setw(lbl_col_width) << "raw." + prefix << setw(inst_col_width) << "equ" << '0' << sect.raw_offs << 'h' << endl;
ofs << setw(lbl_col_width) << "rsize." + prefix << setw(inst_col_width) << "equ" << '0' << sect.raw_size << 'h' << endl;
ofs << setw(lbl_col_width) << prefix + "_vsize" << setw(inst_col_width) << "equ" << '0' << sect.virt_size << 'h' << endl;
ofs << setw(lbl_col_width) << prefix + "_end" << setw(inst_col_width) << "equ" << "virt." + prefix << " + " << prefix + "_vsize" << endl;
ofs << endl;
}
void write_section_decl(ofstream& ofs, const string& sect_nm, const string& prev_nm)
{
ofs << setw(lbl_col_width) << "" << setw(inst_col_width) << "section" << sect_nm << " vstart=virt" << sect_nm;
if (prev_nm != "") {
ofs << " follows=" << prev_nm;
}
ofs << endl;
}
void write_bottom(ofstream& ofs)
{
ofs << endl;
ofs << "; start in the .hdrs pseudo section" << endl;
ofs << " section .hdrs" << endl;
ofs << "%assign cur_raw raw.hdrs" << endl;
ofs << "%assign cur_virt virt.hdrs" << endl;
ofs << "%assign cur_rsize rsize.hdrs" << endl;
ofs << endl;
ofs << "; move assembly position to the start of a new section" << endl;
ofs << "%macro va_section 1" << endl;
ofs << " incbin ptarget, cur_raw + ($-$$), raw%1 - (cur_raw + ($-$$))" << endl;
ofs << " section %1" << endl;
ofs << " %assign cur_raw raw%1" << endl;
ofs << " %assign cur_virt virt%1" << endl;
ofs << " %assign cur_rsize rsize%1" << endl;
ofs << "%endmacro" << endl;
ofs << endl;
ofs << "; move assembly position forward within the current section." << endl;
ofs << "; use 'va_org end' at the end of the code to append the remainder of the original data" << endl;
ofs << "%macro va_org 1" << endl;
ofs << " %ifidn %1, end" << endl;
ofs << " incbin ptarget, cur_raw + ($-$$)" << endl;
ofs << " %elif %1 >= cur_virt && %1 < cur_virt + cur_rsize" << endl;
ofs << " incbin ptarget, cur_raw + ($-$$), %1 - (cur_virt + ($-$$))" << endl;
ofs << " %else" << endl;
ofs << " %error address %1 out of section range" << endl;
ofs << " %endif" << endl;
ofs << "%endmacro" << endl;
ofs << endl;
ofs << "%endif" << endl;
}
int _tmain(int argc, _TCHAR* argv[])
{
// this needs unicode disabled...
string exe_nm = argv[1];
if (exe_nm == "") return_err("error in args", 1);
ifstream exe_file(exe_nm.c_str(), ios::in | ios::binary);
if (! exe_file) return_err("file not found", 1);
IMAGE_DOS_HEADER dos_hdr;
exe_file.read(reinterpret_cast<char*>(&dos_hdr), sizeof(IMAGE_DOS_HEADER));
if (dos_hdr.e_magic != IMAGE_DOS_SIGNATURE) return_err("dos signature not found", 1);
IMAGE_NT_HEADERS nt_hdrs;
exe_file.seekg(dos_hdr.e_lfanew);
exe_file.read(reinterpret_cast<char*>(&nt_hdrs), sizeof(IMAGE_NT_HEADERS));
if (nt_hdrs.Signature != IMAGE_NT_SIGNATURE) return_err("nt signature not found", 1);
DWORD img_base = nt_hdrs.OptionalHeader.ImageBase;
IMAGE_SECTION_HEADER cur_section;
WORD sect_cnt = nt_hdrs.FileHeader.NumberOfSections + 1;
vector<Section_hdr> sections(sect_cnt);
for (int i = 1; i < sect_cnt; ++i) {
exe_file.read(reinterpret_cast<char*>(&cur_section), sizeof(IMAGE_SECTION_HEADER));
string name(reinterpret_cast<char*>(&cur_section.Name[0]), IMAGE_SIZEOF_SHORT_NAME);
sections[i].number = i;
sections[i].name = name.c_str(); // get rid of extra nul bytes in name
sections[i].raw_offs = cur_section.PointerToRawData;
sections[i].raw_size = cur_section.SizeOfRawData;
sections[i].virt_addr = cur_section.VirtualAddress;
sections[i].virt_size = cur_section.Misc.VirtualSize;
}
// section[0] is a pseudo section for the pe-headers
sections[0].number = 0;
sections[0].name = ".hdrs"; // maybe choose a 9-char name to avoid clashes?
sections[0].raw_offs = 0;
sections[0].raw_size = sections[1].raw_offs; // size includes alignment!?
sections[0].virt_addr = 0;
sections[0].virt_size = exe_file.tellg();
if (! exe_file) return_err("failed to read file", 1);
string inc_nm;
make_inc_nm(exe_nm, inc_nm);
ofstream inc_file(inc_nm.c_str());
inc_file << left << hex;
write_top(inc_file, exe_nm, img_base);
if (! inc_file) return_err("failed to write inc file (top)", 1);
for (int i = 0; i < sect_cnt; ++i) {
write_section_info(inc_file, sections[i]);
if (! inc_file) return_err("failed to write inc file (section info)", 1);
}
inc_file << "; pre-define all sections" << endl;
for (int i = 0; i < sect_cnt; ++i) {
string prev_name;
if (i > 0) {
prev_name = sections[i - 1].name;
}
write_section_decl(inc_file, sections[i].name, prev_name);
if (! inc_file) return_err("failed to write inc file (section declarations)", 1);
}
write_bottom(inc_file);
if (! inc_file) return_err("failed to write inc file (bottom)", 1);
return 0;
}
For convenience the macros (which are always the same) are defined in the same include as the exe specific defines. The va_section macro moves to another section by using incbin to insert a chunk of the original executable. You can skip sections, but you can't move backwards, of course. Similarly the va_org macro moves forward within the current section, with "va_org end" as a special case to append the remainder of the original data after the last modification.
This example include file is generated from one of the binaries I'm working with:
; generated using version 0.0.5
%ifndef ilauncher_pe_inc
%define ilauncher_pe_inc
%ifndef ptarget
%define ptarget "ilauncher.exe"
%endif
imagebase equ 0400000h
; .hdrs
virt.hdrs equ imagebase
raw.hdrs equ 00h
rsize.hdrs equ 01000h
hdrs_vsize equ 0290h
hdrs_end equ virt.hdrs + hdrs_vsize
; .text
virt.text equ imagebase + 01000h
raw.text equ 01000h
rsize.text equ 07000h
text_vsize equ 06d16h
text_end equ virt.text + text_vsize
; .rdata
virt.rdata equ imagebase + 08000h
raw.rdata equ 08000h
rsize.rdata equ 02000h
rdata_vsize equ 01f8ah
rdata_end equ virt.rdata + rdata_vsize
; .data
virt.data equ imagebase + 0a000h
raw.data equ 0a000h
rsize.data equ 01000h
data_vsize equ 04604h
data_end equ virt.data + data_vsize
; .rsrc
virt.rsrc equ imagebase + 0f000h
raw.rsrc equ 0b000h
rsize.rsrc equ 07000h
rsrc_vsize equ 06830h
rsrc_end equ virt.rsrc + rsrc_vsize
; pre-define all sections
section .hdrs vstart=virt.hdrs
section .text vstart=virt.text follows=.hdrs
section .rdata vstart=virt.rdata follows=.text
section .data vstart=virt.data follows=.rdata
section .rsrc vstart=virt.rsrc follows=.data
; start in the .hdrs pseudo section
section .hdrs
%assign cur_raw raw.hdrs
%assign cur_virt virt.hdrs
%assign cur_rsize rsize.hdrs
; move assembly position to the start of a new section
%macro va_section 1
incbin ptarget, cur_raw + ($-$$), raw%1 - (cur_raw + ($-$$))
section %1
%assign cur_raw raw%1
%assign cur_virt virt%1
%assign cur_rsize rsize%1
%endmacro
; move assembly position forward within the current section.
; use 'va_org end' at the end of the code to append the remainder of the original data
%macro va_org 1
%ifidn %1, end
incbin ptarget, cur_raw + ($-$$)
%elif %1 >= cur_virt && %1 < cur_virt + cur_rsize
incbin ptarget, cur_raw + ($-$$), %1 - (cur_virt + ($-$$))
%else
%error address %1 out of section range
%endif
%endmacro
%endif
And here is the asm file, in this case the patch is minimal. (Actually it's been made more complex to serve as an example.) It modifies some existing code to change a logfile path and adds the path data in the unused space at the end of the .rdata section. Because of the added data, the .rdata section header is updated at the beginning of the file, before the assembly position is moved into the .text section:
%include "ilauncher_pe.inc"
bits 32
; update VirtualSize in the .rdata section header
;
va_org 400220h
dd new_size_rdata
va_section .text
; patch: store the path string in the buffer. the patch replaces part of the
; code which would set up the path as a folder in the user's Documents folder
;
va_org 401249h
mov eax, [relpath]
mov [edi], eax
jmp skip_buf ; continue, skipping normal path setup
nop
nop
va_org 40128bh
skip_buf:
va_section .rdata
; dword sized relative path for "launcher.log", no trailing '\'
;
va_org rdata_end
relpath db '..', 0, 0
new_size_rdata equ $-$$
va_org end
Running "nasm -o ilauncher-patched.exe ilauncher.asm" will then produce the patched executable.
The patch for the main executable contains 12 functionally separate subpatches with about 30 modifications to existing code and data, and about 5K of new code and data. So I have an include for each subpatch and use one-off macros for the various modifications, because the order in which they must be inserted is given by their absolute addresses, and modifications from different subpatches will often need to be interleaved. (The need to keep the absolute addresses manually sorted is the main caveat here.)
