ASM Community

Hi Coders,
i've downloaded _masta_'s tutorial no. 1 (i.e. the search & destroy patcher). This Program reads a file in memory, searches for a specific pattern and changes it to the new value. The problem is that my pattern isn't found. The source is TASM specific and I want it to work under MASM. Maybe you find the errors and can help me... :)
I've posted my try to convert it to MASM... Have a look at it...

Here's the link to _masta_'s tutorial:

Thx a lot,
DaEagle99

Here's some code from the patcher I wrote. Should be easy to understand :)

[...]

            invoke CreateFile, addr szBakBuffer, GENERIC_READ or GENERIC_WRITE,

                               0, 0, OPEN_EXISTING,

                               FILE_ATTRIBUTE_NORMAL, 0

            mov hFile, eax

            inc eax

            or eax, eax

            jz @@error_open



            invoke GetFileSize, hFile, 0

            mov hSize, eax

            cmp eax, nSize

            jne @@error_size



            invoke GlobalAlloc, GHND, hSize

            mov hMem, eax



            invoke GlobalLock, eax

            mov pMem, eax



            invoke ReadFile, hFile, pMem, hSize, addr hTmp, 0



            mov ecx, pMem



            mov byte ptr [ecx+00033131h], 090h ; 90h = nop



            invoke CreateFile, addr szCrkTarget, GENERIC_WRITE, 0, 0,

                               CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0

            push eax

            invoke WriteFile, eax, pMem, hSize, addr hTmp, 0

            pop eax

            invoke CloseHandle, eax

            invoke MessageBox, hWin, addr szFinished, addr szCopyright, MB_ICONINFORMATION or MB_OK



            jmp @@exit



    @@error_open:

        invoke MessageBox, hWin, addr szOpenError, 0, MB_ICONERROR or MB_OK

        jmp @@exit



    @@error_size:

        invoke MessageBox, hWin, addr szSizeError, 0, MB_ICONERROR or MB_OK

        jmp @@exit



    @@exit:

        invoke GlobalUnlock, pMem

        invoke GlobalFree, hMem

        invoke CloseHandle, hFile

[...]

Why to search for the string, if you want to do what you described? You can look up the location of the strings with a hex editor and place the correct offsets in my code. Just do a loop, wich increments the offset by one for each char of the password and you're done :cool:

Just remember that you will have to do the configuration from an
external program, as you cannot write to an executable file that is
in-use.

Back in the old dos days, this was all very easy. You could calculate
file offset of a variable from a SEG:OFS pair.

Those GAMECHEAT style patchers require that the target file be loaded into memory, either by you, or by the operating system. Either way, you may now search through the range of memory for your data and modify it in any way you wish - but the changes are NOT permanent.

Should you wish to make the changes permanent, and the target is not executable, you may simply save the new file... but if it is executable, you have two ways to go - you can write a small program which makes this change in memory every time the exe is loaded into memory (AFTER it is loaded) or you can attempt to save the new exe image and then correct the CRC checksum.

A CRC (cyclic redundancy check) is basically just a tally of all the data in the file ... although there are several different algorythms for calculating these, depending on the situation.

The checksum is the Tally stored within the file also (checksum is usually calculated with tally=0)

It is used to determine if the data in the file is at all corrupted (which is what you have done by modifying it).

I will only confuse you further by attempting to describe the easiest methods of CRC-repair, so I won't go there right now.
Rest assured there are existing tools to repair incorrect CRC in executables and you don't need to worry about it.

Don't use these techniques to mess with copyrighted software or else Hutch will stomp on you !! LOL
(BTW Hutch I'm from Melbourne, Vic. and a cranky old bastard also :p)

No need to update PE checksum unless you're messing with NT drivers.
And then you'll have a lot more to think about than just the PE checksum :).