i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to start this patched exe-file, i got the message: "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore". It seems that the original exe file protects itself against changing. Does anyone know, how that works and how to bypass it?
1 Answer
Sound's like the program checks for validity.
I can think of two ways to solve it (pretty much the same way with a twist):
1. find where it calculates the checksum and verify it, you can patch it to always look valid
2. find where it calculates the checksum, breakpoint right after the checksum is calculated and place the calculated checksum in the file instead of the original checksum.
You can patch the binary at run-time, if it doesn't pop a message, it only check the checksum once (as opposed to checking it repeatedly in a different thread). If it does pop a message, you can find the function pointers passed to CraeteThread, once of the pointers should take you to the functions that verifies the checksum.
If the message doesn't pop, you can find the checksum calculation by looking at x-refs from the start of each segment (the .text segment is likely to get x-refed by this code).
If, for some reason, only the checksum of some of the .text segment is calculated and checked, you can simply search for strings "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore", find where it's referenced and check for the validation around that
-
I tried to find the string in the exe file. It seems that the string is generatet in a windows dll and not in the exe file i have changed. So i need to find the place, where the checksum is calculated and the dll is called, but i didnd find yet. Commented Dec 25, 2018 at 17:07
-
unlikely that it's a part of windows. i'd guess it's in one of the dlls in the same folder as your executable– user22970Commented Dec 25, 2018 at 21:26
-
yes, i think that too, but unfortunately there are more than 30 dll's in that folder. The other point is, that exactly the same text is known from other software too (i checkted it in google). Thats looks more like a windows dll. Commented Dec 25, 2018 at 22:01
JEtoJNEor vice-versa. And don't change any other bytes./integritycheckswitch which turns on a flag in the PE header. In such a case the loader will check the signature and complain if the signed file was tampered with. However, since you give barely any relevant information it's hard to tell whether this is the case here.