We look at the EAX register: it is 00402000. Now, we step through the first instructions, until we reach CALL EAX: We note the beginning address of this block - 7714EAE0 - for reference, and go back to the origin ( Numpad *). After pasting it looks like this: (end trimmed in screenshot) This will lead us to the exact location where we should paste the second dump. The easiest way to do so is selecting the last instruction of the first block ( HALT), pressing Ctrl+G or Go to > Expression, and appending +FDE.

Now, it is very important to paste the hex dump and memory dump bytes exactly 0xFDE bytes apart (distance between 0x00402000 and 0x00401022), so the original structure is intact. We end up with the following block of instructions: We now have to insert our first dump at the origin (current execution point) using Ctrl+Shift+V, or right-click > Binary > Paste (Ignore Size). The process initializes, and we stop at the System breakpoint: We start up x32dbg (not 圆4dbg, since we are working with x32 code), and open any 32-bit executable. Next, we have to find ourselves some executable space. I found the latter method a lot more fun, and even potentially faster, so in this solution we will stick to it.įirst, we have to convert the dump to plain bytes.

Unicorn), or use a debugger to hijack any program’s execution flow and replace its instructions with the ones given in our dump. There are two main ways to approach the situation: we can use a x86 emulator (e.g.

Windows 10 arc gamer edition x64dbg