5 ms·

The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't rememb

The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.

dopeboy 4y ago
Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?
- rootw0rm 4y ago
  You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc. For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.
- kaszanka 4y ago
  The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
- coretx 4y ago
  JMP 0x"target"
- rsaxvc 4y ago
  Everyone else has mentioned the easy part - replacing the function entry with "return not money" The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.
  - ottello 4y ago
    I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
  - Double_a_92 4y ago
    > start with the error string - find it in the file This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.
    - flatiron 4y ago
      did you check DLLs?
- ale42 4y ago
  Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.

The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.

dopeboy 4y ago

Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?

rootw0rm 4y ago
You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc. For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.
kaszanka 4y ago
The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
coretx 4y ago
JMP 0x"target"
rsaxvc 4y ago
Everyone else has mentioned the easy part - replacing the function entry with "return not money" The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.
- ottello 4y ago
  I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
- Double_a_92 4y ago
  > start with the error string - find it in the file This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.
  - flatiron 4y ago
    did you check DLLs?
ale42 4y ago
Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.