i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to start this patched exe-file, i got the message: "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore". It seems that the original exe file protects itself against changing. Does anyone know, how that works and how to bypass it?
Sound's like the program checks for validity.
I can think of two ways to solve it (pretty much the same way with a twist):
1. find where it calculates the checksum and verify it, you can patch it to always look valid
2. find where it calculates the checksum, breakpoint right after the checksum is calculated and place the calculated checksum in the file instead of the original checksum.
You can patch the binary at run-time, if it doesn't pop a message, it only check the checksum once (as opposed to checking it repeatedly in a different thread). If it does pop a message, you can find the function pointers passed to
CraeteThread, once of the pointers should take you to the functions that verifies the checksum.
If the message doesn't pop, you can find the checksum calculation by looking at x-refs from the start of each segment (the
.text segment is likely to get x-refed by this code).
If, for some reason, only the checksum of some of the
.text segment is calculated and checked, you can simply search for strings "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore", find where it's referenced and check for the validation around that