During the forensic analysis, we found a code cave — a long sequence of null bytes in the process's memory that attackers had used to inject custom instructions.

The reverse engineer found several code caves in the firmware where he could hide a patch.