1

In Olly I managed to patch the file to no longer compare for a specific flag. Is it possible to automate this?

Basically I changed a JNZ to a JZ.

Is there a way to could do the same thing with a hex editor?

The end goal would be to create a program to automate this patch.

Thanks.

  • what do you mean with 'automate'? you mean something like a plugin for Olly? or a standalone program that patches another program? – rev Feb 7 '15 at 23:39
  • Don't get me wrong, but if you replaced jnz by jz you did not patch anything to no longer compare any flag. You merely inverted the condition. Patching it to jmp would have been the proper way. – 0xC0000022L Jun 13 '18 at 13:58
6

Okay, I suppose you just want to create a program that patches the already existing file, so here's how I'd do it.


First, you need the offset in the file. That means that offset 0 is the first byte, 1 is the second, etc, as opposed to the offset + base which you see in memory.

To get that offset, right click the instruction, and go to View > Executable file:

executable file (to get the offset)

And you take the offset:

relative offset

which is 0x16A7 in my case.


Once you have the offset, you must code a program to patch the program. Here's a few ways: (I only tested the Python one, but the rest should work)

C++

#include <iostream>
#include <fstream>

int main() {
    std::ofstream f("file_to_patch.exe", std::ios::binary);
    // seek to the desired offset
    f.seekp(0x16A7);
    // \x74 to \xEB, for example (conditional short to unconditional short)
    const char bytes[] = "\xEB";
    f.write(bytes, sizeof(bytes));
    f.close();
    return 0;
}

C

#include <stdio.h>

int main(void) {
    FILE* f = fopen("to_patch.exe", "r+b"); // open
    fseek(f, 0, 0x16A7); // seek to the offset to patch
    fwrite((void*) "\xEB", 1, 1, f);
    fclose(f);
    return 0;
}

Python

In case you want to script it and don't wanna bother with C / C++, here's how you do it with Python:

f = open("to_patch", "r+b") # open in read/write binary
f.seek(0x16A7) # seek to the previously found offset
f.write(bytearray([0xEB])) # patch the jump
f.close()
| improve this answer | |
  • Shortly after posting the question, I managed to find the offset and to patch the program using python. This is EXACTLY how I did it. However, I realized the offset will change when the program updates, might need to make my solution a little more robust... – NewReverser Feb 8 '15 at 0:49
  • @NewReverser how does it change? what do you mean? – rev Feb 8 '15 at 1:37
  • Between build versions the offset might change depending if they add features, change the code around, etc. – NewReverser Feb 8 '15 at 17:55
  • oh, I thought it changed in the same binary. in that case, you can use patterns to find your code. sadly I haven't ever done it with Olly, but in case you have IDA, it's easy as getting a sigmaker plugin (I can link one if you want), and then using it from your code. there's a lot of info about this on the internet, but do tell me if you need clarification on anything. – rev Feb 8 '15 at 18:07
  • 1
    IDA is an amazing tool, more than what you seem to think. it also has a x64 version, so indeed you can use it to take signatures from both versions. – rev Feb 8 '15 at 19:18
2

If you want a patch tool you dont need to code it. Use dUP (diablo2oo2 Universal Patcher) or R!SC Process Patcher to easily create a .exe that patches your defined offsets with your defined values.

| improve this answer | |
2

With OllyDBG2, there is an option for it : Edit > Copy to Executable

Showing the context menu item described above

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.