> For the complete documentation index, see [llms.txt](https://docs.hyperdbg.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hyperdbg.org/commands/scripting-language/examples/patch-the-normal-sequence-of-execution.md).

# patch the normal sequence of execution

An example of patching eflags of the target program

One of the powerful features of HyperDbg's script engine is its ability to change the target program's normal execution flow. These changes are applied from the hypervisor level, so it's hidden from the program's layer.

To demonstrate an example of this method, we compiled the following C++ program. A simple infinite loop that always shows a message (`"test_bool is TRUE !\n"`). It's because the `test_bool` variable is filled with `ture`.

```clike
#include <iostream>
#include <Windows.h>

int main()
{
    bool test_bool = true;

	while (true)
	{
		if (test_bool == true)
		{
			std::cout << "test_bool is TRUE !\n";
		}
		else
		{
			std::cout << "test_bool is FALSE !\n";
		}

		Sleep(2000);
	}
}
```

You can use your favorite static analyzer like IDA Pro, or Ghidra to see the source code, but in this example, I used [x64dbg](https://x64dbg.com/) to show you what exactly we want to patch. As you can see, the above code is converted to the following assembly codes, and our condition `if (test_bool == true)` is assembled at `004C5A1C` with a **JNE** instruction.

![Assembly code of loop function](https://1255335821-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2wWz6ePF27bvsJcWed%2Fuploads%2Fgit-blob-e7d014f6534361d2e08c97ad75c2373a11dca656%2Ffind-the-target-patch-address-x64dbg.PNG?alt=media)

As you might know, **JNE** instruction decides whether to perform the jump or not based on the **Zero Flag**. Thus, if we change the `@zf` register, the jump is performed, and we should see the second message (`"test_bool is FALSE !\n"`).

Note that in our case, the process id is **225c**.

So, we use the following hidden breakpoint to change the **@zf** flag.

```clike
!epthook 004C5A1C pid 225c script {
	@zf = 0;
}
```

{% hint style="success" %}
In the above script, you can change all of the registers supported by HyperDbg, like general-purpose register, RFLAGS, etc.
{% endhint %}

Now, let's test our theory. If we run the above HyperDbg script, we can see that the message is changed.

![Applying the patch](https://1255335821-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2wWz6ePF27bvsJcWed%2Fuploads%2Fgit-blob-72aca09ae7d007cf88c3f88a9d1cbe800cf8ad8d%2Fpatch-the-target-address.PNG?alt=media)

If we clear the event, we can see that the results are returned to the previous form.

![Clearing the patch](https://1255335821-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M2wWz6ePF27bvsJcWed%2Fuploads%2Fgit-blob-4f85cad810ea32047f8a2ab7f7d989acb8ca2f78%2Fclearing-the-patch-events.PNG?alt=media)

This was an example of changing the program's flow without attaching to the target process. You can also change the memory using [eb, ed, eq](https://docs.hyperdbg.org/commands/scripting-language/functions/memory/eb-ed-eq) functions.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.hyperdbg.org/commands/scripting-language/examples/patch-the-normal-sequence-of-execution.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.