I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with the app process explorer, but I'd like to not do it everytime... Have you any idea to help me? I'm really new to mutex, semaphores, and stuff like this, and I have no idea how I can erase it from the app.
There are 2 methods to do do this:
- Use an API hook to intercept the call to
CreateMutexand change the mutex name (e.g. randomize it).
- Make a copy of the executable or dll that calls
CreateMutexand search the Mutex name with a Hex editor (search for both ANSI and Unicode strings and modify the string. Make sure that you don't change the length of the string.
You need to find the code which creates the mutex. I.e. the call to CreateMutex/OpenMutex API function. And then patch it by overwriting the opcodes. So you'll need to learn how to disassemble and how to patch the code of the executable. If it's new for you, you should try from some crackme tutorial, which will teach you to do this.
I did it. First I replaced the first instructions of the subroutine calling Windows API's CreateMutex by the "ret" of this function (it wasn't only "ret", but "ret xxxh", i don't know why). Then, I avoided the error call when handle is 0 (null) with a simple "jz" to "jmp" change.
Edit: I could also have nopped the call and the 3 arguments before it, instead of replacing the first instruction of the call by ret.