Patch a Constant Value in a Binary

Binary Patching

Binary patching modifies an executable file directly without recompiling from source. Crackme solvers, malware analysts, and hotfix engineers all patch bytes in place when they need to change program behavior quickly.

Finding and Applying a Patch

The workflow:

1. Disassemble the binary and find the target instruction
2. Note the file offset (not the virtual address)
3. Convert VA to file offset: offset = VA - section_VA + section_file_offset
4. Verify bytes at that offset match expected instruction encoding
5. Write new bytes and save

For example, changing a conditional jump from JNE (0x75) to JE (0x74) inverts a license check with a single-byte patch.

For This Exercise

You will search a simulated binary for a target byte pattern, show the offset where it was found, and replace it with new values. This teaches the VA-to-file-offset conversion that Ghidra and IDA automate when you edit instructions in the decompiler view.

Patch Safety and Relocation

Changing instruction length breaks PC-relative call and jmp targets in x86 code. Single-byte patches (like flipping a jump opcode) are safest because they preserve instruction boundaries. Signed binaries detect any byte change via hash verification, which is why operating systems enforce code signing on boot loaders and app store distributions. Always work on a copy and document the original bytes before patching.