2.10 Patching in x64dbg

While performing malware analysis, you may want to modify the binary to change its functionality or reverse its logic to suit your needs. x64dbg allows you to modify data in the memory or instructions of a program. To modify the data in a memory, navigate to the memory address and select the sequence of bytes you want to modify, then right-click and choose Binary | Edit (Ctrl + E), which will bring up a dialog (shown as follows) that you can use to modify the data as ASCII, UNICODE, or a sequence of hex bytes:

The following screenshot shows the code excerpt from the TDSS rootkit DLL (this is the same binary that was ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.