3

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?

8
  • 1
    In simple term, patching is as same as editing a file.
    – Biswapriyo
    Aug 13, 2019 at 17:34
  • Hi and welcome to RE.SE. Given the context, I guess the idea is to no allow "cheating" by making ones cracking job easier using well-established techniques? I am not sure how to interpret it, though. Is patching not allowed in the executable image on disk? Not anywhere? What about automated kinds of instrumentation or techniques such as hooking, LD_PRELOAD and friends? ...
    – 0xC0000022L
    Aug 13, 2019 at 21:02
  • @0xC0000022L generally it means a submitted solution to the crackme challenge that relies on patching (static file modification) won't be accepted by the crackme author. I think DLL injection and such usually is ok unless specifically stated by the crackme author that it isn't. (I've had a lot of success using LD_PRELOAD)
    – julian
    Aug 14, 2019 at 3:21
  • To OP, can you share the crackme link?
    – Biswapriyo
    Aug 14, 2019 at 7:04
  • 1
    @0xC0000022L No problem, and your right, LD_PRELOAD is a beautiful thing. I forgot to mention that the reason it is usually acceptable is that if DLL injection is something the crackme author is concerned about, they will provide a statically-linked binary rather than saying "No LD_PRELOAD".
    – julian
    Aug 14, 2019 at 12:11

2 Answers 2

3

Following quote comes from unix.stackexchange:

To patch a file means to modify it, with the connotation that the modification is generally small.

So, patching the executable is a process of changing its content usually performed for changing its original behaviour.

Patching is obviously not allowed means that the author of a particular crackme wants you to crack it without modifying its content. For instance, consider a simple program:

ask_user_for_password();
read_input();
if (isPasswordCorrect())
    printf(“Congratulations, you have cracked it!\n”);
else
    printf(“Wrong password! Try again!\n”);

Of course one can patch it so that it always prints the "Congratulations [...]" message, but the point of this very simple crackme is to actually find that password somehow (by finding decryption key for example).

Generally, to patch a file, you want to:

  1. Find the place / instruction you want to change (it may be jnz to jz as @Axel Munoz said, but it may be a jmp to the location containing the code you want to be executed as well).
  2. Find out what is the machine code representing the instruction you want to put there - it can be done by first compiling the program written in assembly and then disassembling it. If you are working on x86 architecture, you can use this site as well.
  3. Open the binary in a hex editor, find the offset where you want to put your code and just paste the machine code you obtained in the previous step.
-1

The term "patching a [binary]" means to modify the instruction set. For example if there is a conditional jump that requires some memory to be set to a specific value, instead of modifying the memory, which might be the objective of the crackme, I could simply patch the binary to always take that jump (either by changing the condition of the jump from jnz to jz). Patching through a debugger easily allows me to change the instruction, save the new binary, and then run it.

Here is some more info.

6
  • 2
    You are pretty inaccurate by saying that patching means modifying instruction set, but link is good.
    – Croll
    Aug 14, 2019 at 10:33
  • I honestly never understood the point of inverting the condition (jnz to jz). It seems odd to change one conditional jump into another conditional jump when an altogether unconditional jump exists ...
    – 0xC0000022L
    Aug 14, 2019 at 10:57
  • @0xC0000022L It may be useful when there is a bug in the program and you want to invert an if-else block for example to fix it. But I agree it’s rather rare case.
    – bart1e
    Aug 14, 2019 at 11:04
  • @Croll I agree it's not the best way to phrase, how would you put it?
    – Axel Munoz
    Aug 14, 2019 at 11:17
  • 1
    I know what you mean (modifying code/logic in the binary), but "instruction set" refers to the set of instructions recognized by a CPU and is tied together with CPU architecture. For example the x86 instruction set is different from the MIPS instruction set
    – julian
    Aug 14, 2019 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.