2

After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.

I'm actually newbie in reverse engineering so would be nice to get any advice, thanks.

enter image description here

5
  • Hi and welcome to RE.SE. So what's the question? If you are trying to patch the runtime and are dealing with the static libs, you may be able to achieve this differently. Similarly if you are trying this on the dynamic libs for the C/C++ runtime, you should be able to place your patched version next to the binary. But you don't give any details of what you patched (or are trying to patch) nor do you share relevant details. Also, please don't post text as a screenshot. It makes it difficult or impossible for search engines to index such a Q&A.
    – 0xC0000022L
    Commented Jan 29, 2023 at 21:01
  • I don't clearly understand in which direction I've should dig, the goal is make app work with modified code. Libs are dynamic. It's stop work properly with any sort of patching of code except data, which even doesn't run so i think there's some sort of image protection. Commented Jan 29, 2023 at 21:17
  • That could be anything from the simple PE checksum in the optional header to something more aggressive like checking whether the file is validly signed. But it's not even clear what is being patched and what doesn't run at this point. None of us knows what's in front of you. That's the part you need to describe if you want help.
    – 0xC0000022L
    Commented Jan 29, 2023 at 22:53
  • Well I've already tried to change checksum in additional header, it doesn't impact anything, same with the windows certs. For now im trying to patch int value "ADD R8D,0x1499700" to "ADD R8D,0x1999700", it's timer offset in msec - im trying to change from 6 hours to 7.5, the point is that code doesn't even execute so that why im focusing on the runtime protection now. There is a mess of code on initialization steps and figuring out what exactly wrong feels insanely difficult for me. Commented Jan 29, 2023 at 23:20
  • Are you saying it calls CreateWindowExA function, and that fails? Need to understand where it runs to and when it fails what are the errors/exceptions. i.e. if CreateWindowExA fails what does GetLastError return for example. This likely would be very easy to troubleshoot with a TTD trace learn.microsoft.com/en-us/windows-hardware/drivers/debugger/… Commented Feb 2, 2023 at 12:31

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.