Patch and thread rules

{"id":"steady_clock","mnemonic":"RDTSC","steps":"load_imm r0,1; load_imm r3,0"}

1. 1
   Find the instruction. The debugger shows each one as module and offset, like app.exe+0x4f10: that offset is the RVA. Nothing to compute.
2. 2
   Write the rule: the place ("module" and "rva") and the replacement ("replace_hex" or "steps").
3. 3
   Run again with it, from the config file or the window's Advanced settings, then check in the debugger that the instruction now does what you meant.

{"id":"nop_2byte","module":"app.exe","rva":"0x4f10","replace_hex":"90 90"}

Choosing the instruction

By address, the most exact; by its bytes, wherever they are; by its name; or several at once, which must all fit:

{"id":"nop_2byte","module":"app.exe","rva":"0x4f10","replace_hex":"90 90"}
{"id":"steady_clock","signature":"0F 31","steps":"load_imm r0,1; load_imm r3,0"}
{"id":"quiet_cpuid","mnemonic":"CPUID","steps":"load_imm r0,0; load_imm r1,0; load_imm r2,0; load_imm r3,0"}
{"id":"rdtsc_only","mnemonic":"RDTSC","signature":"0F 31","steps":"load_imm r0,1; load_imm r3,0"}

Replacing it

Raw bytes: five NOPs over a five-byte call, so the call never happens; two bytes that set eax to zero.

{"id":"skip_call","module":"app.exe","rva":"0x2210","replace_hex":"90 90 90 90 90"}
{"id":"eax_zero","module":"app.exe","rva":"0x2240","replace_hex":"31 C0"}

Steps can run the original instruction (passthrough) and then change its result; without it, the steps are all the instruction now does.

{"id":"force_zero","module":"app.exe","rva":"0x2210","steps":"passthrough; load_imm r0,0"}
{"id":"shifted","module":"app.exe","rva":"0x2300","steps":"passthrough; mov_rr r0,r1; add_ri r0,r0,16"}
{"id":"seed","module":"app.exe","rva":"0x1200","steps":"load_imm r2,42"}

Operations separated by ;, arguments by commas, run in the order written. Names are not case sensitive; an operation takes up to four arguments. A misspelled step or an argument out of range makes the whole rule skipped: after a first run with a new rule, look at its instruction in the debugger.

Text in the program's memory

A step only holds numbers, so a text is first placed in memory and the step is given its address. Here the first argument of a call (rcx, r2) is pointed at another path just before the call:

{"id":"other_target","module":"app.exe","rva":"0x3a40","steps":"load_imm r2,@text_app; passthrough","text_app":"C:/work/other.exe"}

A rules file

With "patch_rules": "rules.jsonl" in the config file, next to it:

# time: a steady clock
{"id":"steady_clock","mnemonic":"RDTSC","signature":"0F 31","steps":"load_imm r0,1; load_imm r3,0"}

# threads that only add noise
{"id":"no-jobs","thread":"ignore","name":"Job*"}

A thread rule has "thread":"ignore" or "thread":"record"; every field given must match. Threads are checked when they start, and again when they get a name (some programs name them late).

As soon as one record rule exists, every thread no record rule names is off, the main thread included unless a rule names it. The capture then holds only the threads you chose.

{"id":"no-jobs","thread":"ignore","name":"Job*"}
{"id":"no-worker","thread":"ignore","module":"worker.dll","rva":"0x4010"}
{"id":"only-checker","thread":"record","module":"app.exe","rva":"0x4010"}