PAGE Video stream hijacking Step 5 - Patch the function (Poor man's way): Picking up from previous step, we wanted to modify the function at 0x16D48 ( send_picture_in_stream ), basic block 0x16DA8 with the following code: image_counter = 0; image_data = malloc(size_of_image); [r4, #4] = image_data; sprintf(&image_data, /home/my_picture_%d , image_counter); f = fopen(image_data, rb ); fread(&image_data, 1, size_of_image, f); fclose(f); [R4, #0xC] = size_of_image; image_counter ++; image_counter = image_counter % number_of_images; 136