Reverse › Module 7 › Lesson 3
Patch Literacy
Patch literacy on YOUR $RE_LAB toy binary — hex edit, NOP, jump flip, checksum awareness; never patch commercial software for piracy.
Visual · t23_patch_literacy
Patch literacy = edit YOUR toy binary on $RE_LAB. Not piracy. Original Cyberlium.
Opening
Changing one byte to flip a jump teaches machine code — patching Photoshop does not.
Patch literacy is the skill of modifying YOUR lab binary at the file or memory level to change behavior: locate conditional jump after compare, patch JE to JNE or NOP out check, edit immediate constant, understand file offset vs virtual address on PE/ELF. Tools: xxd/hex editor, Ghidra patch instruction export, write and re-run on $RE_LAB. Teach checksum/hash change awareness — patched file new SHA256. Cyberlium EXPLICITLY limits patches to YOUR crackme/toy and brief-assigned CTF binaries — NOT Adobe, NOT games, NOT DRM, NOT distributing 'cracked' exes. Document before/after hash and offset in chmod 600 notes.
1. Patch types (toy scope)
NOP slide over compare, invert jump opcode, change immediate, patch string constant in YOUR toy.
Map VA to file offset using readelf/objdump/PE tools from Module 4.
Command guide
Try these commands — Patch types (toy scope)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
strip(1) — https://man7.org/linux/man-pages/man1/strip.1.html (symbol removal literacy) nm after strip — https://man7.org/linux/man-pages/man1/nm.1.html (compare symbol tables) Binary Ninja patching — https://docs.binary.ninja/ (patch literacy on YOUR toys only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils
macOS: Built-in (Xcode CLI) or brew install binutils Built-in or brew install binutils
Windows: Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # strip objdump nm
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cp "$LAB_RE/bin/check" "$LAB_RE/bin/check.stripped"
strip --strip-all "$LAB_RE/bin/check.stripped"
nm "$LAB_RE/bin/check" | grep ' main' | head -2
nm "$LAB_RE/bin/check.stripped" 2>&1 | head -3
objdump -d "$LAB_RE/bin/check.stripped" | grep -A6 '<main>:' | head -8Primary tools to practice this lesson: strip, objdump, nm. Reference sites: strip(1) (https://man7.org/linux/man-pages/man1/strip.1.html); nm after strip (https://man7.org/linux/man-pages/man1/nm.1.html); Binary Ninja patching (https://docs.binary.ninja/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verify patch
Re-run patched binary on $RE_LAB; confirm behavior change matches hypothesis; new hash logged.
If self-checksum in toy, document detection — literacy for anti-tamper recognition.
3. Refused use
Commercial piracy patches, keygen logic, DRM removal, sharing patched commercial exes.
Patch literacy proves you read assembly — not that you steal software.
4. What you ship: patch literacy card
Three patch types + VA-to-offset rule + before/after hash + YOUR-toy-only line.
5. What you record before the next lesson
Patch literacy card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Patch licensed binary and upload 'cracked' copy to file share.
Right
Patch literacy on YOUR $RE_LAB toy documented. Next: Crackme Lab.
Mission: patch literacy card
1) Define NOP and jump flip. 2) Write VA-to-file-offset steps. 3) Log before/after SHA256. 4) Write NEVER commercial piracy patch.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Relative jump patch — size pitfall?”
Knowledge Check
APPLY: Patch literacy on Cyberlium applies to:
Multiple choice
Knowledge Check
APPLY: True or False: Distribute patched commercial exe as lab proof.
True or False
Knowledge Check
APPLY: After patch you should log:
Multiple choice