3 replies to this topic

[kruz]

Hey guys,

I love this ASM section and forum all together. I recently did some work on an executable to make it not
ask for a serial (imagine that!).

My question is, how could one take that code that was changed (to jne, simplest form) and make it into a "patch" in some sort of executable format.

Any links/info would be greatly appreciated (also, if it is packed, will it have to be unpacked, patched, packed?)

-kruz

[White Scorpion]

Hey guys,

I love this ASM section and forum all together. I recently did some work on an executable to make it not
ask for a serial (imagine that!).

My question is, how could one take that code that was changed (to jne, simplest form) and make it into a "patch" in some sort of executable format.

Any links/info would be greatly appreciated (also, if it is packed, will it have to be unpacked, patched, packed?)

-kruz

I'm assuming you are attacking a crackme challenge and are not doing anything illegal.

Take a look at reversing.be, they have several tutorials on how to write a patcher, from basic one byte patches, to patching in memory, searching for patterns, etc.
If you still have specific questions after that, let us know

[ninar12]

i also recommend

Win32_Assembler_Coding_for_Crackers_by_Goppit_v11.chm

from [arteam]Goppit

[da_cash]

for simple patching few bytes you may use SetFilePointer and WriteFile API's.


for example:

definitions:

p1	 db			   90h,90h
i	 dd			   ?

invoke	GetFileSize,[hFile],NULL; get filesize from createfile handle				
cmp eax,0027a600h				; compare file size 
je @good								; if match ours do the job 

jmp @exit
@good:
		
invoke SetFilePointer,[hFile],18D04Bh,FALSE,FILE_BEGIN	; set file pointer at offset 18D04Bh from beginning
invoke WriteFile,[hFile],addr p1,2h,addr i,0						; patch the code with 2 nops from  "p1" ,  "i" used to store written bytes 

@exit:																			; koniec i wyjście z programu :]

this is simple method ripped from my old code. I prefer to patch files using matching patterns , it's more pro ..

hope it will help .. :]


Also if your file is packed you should unpack it first , but in certain packers such as asprotect you may use inline patching to patch the code while program unpacks in memory before going to oep (entry point ) and running