Trying to change JE to JNE in x32dbg for instructions that change

Question

I have found two if statements in an application that I want to alter. I've made the two changes and saved the patch file using x32dgb and the application boots up successfully, however; the change doesn't seem to be taking affect nor is it there when I debug the saved patch .exe file.

In short, my patches don't seem to be saved into the new exe!

With my breakpoints saved, I looked the two locations that I need to change, and on initial application load I noticed the addresses contain totally different instructions and not all memory addresses are shown in the left most column.

Here is how x32dgb looked when I successfully loaded the application:

And when application loads:

Any ideas why the patches are not working? Do I need to take a different approach?

Answer 1

At first glance, those two screenshots appear to show completely different instructions within the same memory region, almost as if it's an application that JITs during runtime. (Actually, in the second screen shot, that looks like a region of memory not meant to be disassembled.)

Anyway, you could attempt to patch via a hex editor like HxD. Since you've found the offsets of those instructions, simply open the .exe in HxD (or whatever other hex editor of choice), head to offsets 34EC8 and 34F02, then change each of those bytes according to the appropriate JNE you need for the opcodes you see:

• 34EC8: Change 84 to 85
• 34F02: Change 74 to 75

If you don't see your original bytes of 84 and 74 when you go to those offsets, then something's amiss. If you did and you changed them, then save your patched version, run the executable, and see what happens. If you have the same behavior, then it seems highly likely that there's an integrity check of some sort going on. That will require more effort on your behalf to then solve.

Answer 2

Good news! I've built an application in C++ that forces the instruction change until the end of the splash screen. The code is NOT great, but the application is very stubborn and I had to time the loop just right otherwise the application just closes.

Here is the code in case it helps anyone else.

    #include "stdafx.h"
    #include "iostream";
    #include "atlstr.h";
    #include <windows.h>
    #include <TlHelp32.h>
    #include <stdio.h>
    #include <psapi.h>
    using namespace std;

    #pragma comment(lib, "Psapi.lib")

    PROCESS_INFORMATION CreateVProcess();
    void TryToCrack(PROCESS_INFORMATION processInfo);

    //
    // 85 c0 0f 84 9e 00 00 00
    // 85 c0 0f 85 9e 00 00 00
    // First offset 34EC7, do 34EC8
    //
    // second offset 34F03
    // 74 2E
    // EB 2E


    int main()
    {
        cout << "Launching Application" << endl;
        PROCESS_INFORMATION processInfo = CreateVProcess();
        cout << "Trying to crack..." << endl;
        TryToCrack(processInfo);
        return 0;
    }

    PROCESS_INFORMATION CreateVProcess()
    {
        LPCTSTR path = L"NameOfAppHere.exe";

        // additional information
        STARTUPINFO si;
        PROCESS_INFORMATION pi;

        // set the size of the structures
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        ZeroMemory(&pi, sizeof(pi));

        CreateProcess(
            path,
            NULL,        // Command line
            NULL,           // Process handle not inheritable
            NULL,           // Thread handle not inheritable
            FALSE,          // Set handle inheritance to FALSE
            0,              // No creation flags
            NULL,           // Use parent's environment block
            NULL,           // Use parent's starting directory 
            &si,            // Pointer to STARTUPINFO structure
            &pi             // Pointer to PROCESS_INFORMATION structure (removed extra parentheses)
        );
        return pi;
    }

    void TryToCrack(PROCESS_INFORMATION processInfo)
    {
        Sleep(500);

        HANDLE targetProcess = OpenProcess(STANDARD_RIGHTS_WRITE, 0, processInfo.dwProcessId);
        void* hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, processInfo.dwProcessId);
        MODULEENTRY32 mod32;
        mod32.dwSize = sizeof(MODULEENTRY32);
        Module32Next(hSnap, &mod32);

        DWORD modHandle = (DWORD)mod32.modBaseAddr;

        unsigned char mem1 = 0x85;
        unsigned char mem2 = 0x75;

        for (int i = 0; i < 100000; i++)
        {
            WriteProcessMemory(processInfo.hProcess, (LPVOID)(modHandle + 0x034EC8), &mem1, 1, NULL);
            WriteProcessMemory(processInfo.hProcess, (LPVOID)(modHandle + 0x034F02), &mem2, 1, NULL);
        }   
    }