i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to start this patched exe-file, i got the message: "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore". It seems that the original exe file protects itself against changing. Does anyone know, how that works and how to bypass it?

  • 1
    Why do you need to change an specific byte (JE) without knowing what could happen in both ways? The application might have a CRC Checking to determine if it is modified. – ismael_akez Dec 25 '18 at 10:27
  • Try to change JE to JNE or vice-versa. And don't change any other bytes. – Biswapriyo Dec 25 '18 at 11:03
  • Something the linkers since VS2008 or 2010 provide is the /integritycheck switch which turns on a flag in the PE header. In such a case the loader will check the signature and complain if the signed file was tampered with. However, since you give barely any relevant information it's hard to tell whether this is the case here. – 0xC0000022L Jan 24 at 11:13

Sound's like the program checks for validity.
I can think of two ways to solve it (pretty much the same way with a twist):
1. find where it calculates the checksum and verify it, you can patch it to always look valid
2. find where it calculates the checksum, breakpoint right after the checksum is calculated and place the calculated checksum in the file instead of the original checksum.

You can patch the binary at run-time, if it doesn't pop a message, it only check the checksum once (as opposed to checking it repeatedly in a different thread). If it does pop a message, you can find the function pointers passed to CraeteThread, once of the pointers should take you to the functions that verifies the checksum.
If the message doesn't pop, you can find the checksum calculation by looking at x-refs from the start of each segment (the .text segment is likely to get x-refed by this code).

If, for some reason, only the checksum of some of the .text segment is calculated and checked, you can simply search for strings "File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore", find where it's referenced and check for the validation around that

  • I tried to find the string in the exe file. It seems that the string is generatet in a windows dll and not in the exe file i have changed. So i need to find the place, where the checksum is calculated and the dll is called, but i didnd find yet. – general failure Dec 25 '18 at 17:07
  • unlikely that it's a part of windows. i'd guess it's in one of the dlls in the same folder as your executable – Amirag Dec 25 '18 at 21:26
  • yes, i think that too, but unfortunately there are more than 30 dll's in that folder. The other point is, that exactly the same text is known from other software too (i checkted it in google). Thats looks more like a windows dll. – general failure Dec 25 '18 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.