The next step would be patching calls to gets() and redirecting them to our shim. As we only have a single call to gets() (which is now a call to fgets() with an invalid number of parameters), we will patch the call itself. If we had multiple calls to fgets(), we would then patch the jmp fgets instruction rather than patching each and every call.

As we have already seen, the call is relative to EIP, so we have to calculate a new offset for the call so that it would call our shim code located at 0x414d98. The formula is rather simple:

Here, 0x4117EC is the address of the call instruction and 5 is its length in bytes. We need to use this length of the call instruction as, at the time it is executed, the EIP already points at the instruction immediately following the call. The resulting offset would be 0x35A7.

However, before we can apply this patch, we have to find the right place in the hex editor and we use a few bytes representing this call instruction and a few bytes that follow as shown in the following screenshot:

We used the 0xe8 0xf3 0xfa 0xff 0xff 0x83 0xc4 0x04 bytes for our search. Doing this, one has to make sure such a sequence of bytes appears only once in the search result. Here the 0xe8 is the call instruction and the 0xf3 0xfa 0xff 0xff bytes are the offset from the next instruction --0xfffffaf3. The following screenshot shows the offset patch being applied:

The offset is overwritten with 0x000035a7. Now, the instruction at 0x4117ec would call our shim code. But we still have to implement the shim code.