1

I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files.

Using x64dbg, I've patched out the validity checks for the serial / request / activation strings, and the software does successfully go through it's activation routine.

The problem is that I now need to export the correctly patched DLL in order for the software to work, but x64dbg will only "apply" 3/20 of the necessary patches. It will, however, export a .1337 patch file that contains all 20.

What am I getting wrong?

  • 1
    any error messages? – Igor Skochinsky Jul 20 '18 at 17:20
  • 1
    No errors, per se, other than it says "3/20 patches applied" instead of "20/20" – Mark Schlachter Jul 20 '18 at 17:32
  • Biswapriyo: I don't have / use IDA. I can get it, I'm sure, but I don't know how to use it to re-create my work from x64dbg. Any advice on making the .1337 patch work with IDA? – Mark Schlachter Jul 20 '18 at 17:44
  • 1
    @MarkSchlachter: maybe check if the file on disk has been patched already in the other 17 locations – Igor Skochinsky Jul 20 '18 at 19:17
  • What is the solution for patching at the end of a section? I'm trying to create a code cave but I can't patch the file because of this issue... – Migs Sep 8 at 20:00
3

You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it.

Generally this happens if you add code at the end of a section. In rare cases it could be that there is a bug in converting the virtual addresses to file offsets. If you think that is the case, provide the relevant binary and patch location and open an issue at http://issues.x64dbg.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.