0

How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size.

I tried to patch it while running inside debugger

enter image description here

Still no luck. Any idea how to patch it?

Improve this question
2
  • Question is not really clear. I suggest you edit it and describe more details. – NirIzr Nov 4 '16 at 4:15
  • edited @NirIzr any idea? – F Faisal Nov 4 '16 at 8:46
0

Many possibilities:

  • You didn't unpack the dll properly, maybe you forget to fix the relocations (since it's a dll).
  • The program is using a checksum algorithm to detect if the dll is tampered.
  • That specific dll isn't your target, maybe you should do more dynamic analysis before start unpacking
  • Or any other possibilities.

*P.S: you shall consider inline patching instead of unpacking the dll since your aim is to patch the dll.

Improve this answer
4
  • I can't patch the packed dll inside debugger. i.imgur.com/1OiY1Ci.png – F Faisal Nov 4 '16 at 7:11
  • Did you try using a hex editor instead ? – Yaser Al-Najjar Nov 5 '16 at 18:25
  • yes, it doesn't show the part where i want to patch. Because it's packed. I don't know how to re-map RVA to file Offset – F Faisal Nov 5 '16 at 23:12
  • probably i didn't unpack it properly. – F Faisal Nov 6 '16 at 13:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.