Thread: Patching file
View Single Post
  #5  
Old 07-10-2015, 07:13
maktm maktm is offline
Friend
 
Join Date: Apr 2015
Posts: 23
Rept. Given: 0
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 8
Thanks Rcvd at 16 Times in 8 Posts
maktm Reputation: 4
If it detects whenever a byte is changed then it has a CRC check on the .text section of the file (or something similar). There are multiple ways of going around this, but most of them are complicated. Some methods are:

> Disabling checks completely by finding the functions that check them (Stack tracing comes to mind)
> Finding the stored value for the CRC and then modifying it the exact value required, after the bytes are changed.

All these are pretty difficult but one other method you can do is to reroute control flow by setting breakpoints in the .data/.idata sections or causing exceptions anyhow then catching these exceptions in handlers (using winapi functions to set on top of chain) and then modifying what is required.


Best advice I have is to see how that other guy did it. Compare the two files (original and modified) to see the changes he made.

Hope something here helps
Reply With Quote