| ParkourPenguin | 
			
				|  Posted: Wed Aug 05, 2020 6:25 pm    Post subject: |  
				| 
 |  
				| CE is generally used on running software- i.e. dynamic analysis vs static analysis. If that's fine, figure out where the new addresses are after the OS loads the dll into the process's memory and change it with an AA script like this: 
  	  | Code: |  	  | [ENABLE] foo.dll+538A:
 db 90 90
 
 foo.dll+7190:
 db 90 90
 
 foo.dll+B18C:
 db 90 90
 
 [DISABLE]
 // restore whatever the original bytes are... or don't and delete everything beyond this
 foo.dll+538A:
 db CC CC
 
 foo.dll+7190:
 db CC CC
 
 foo.dll+B18C:
 db CC CC
 | 
 If you want to change the dll itself, CE can attach to files on disk. I'm not terribly familiar with it but I can't imagine it would be much different.
 |  |