Hacker News new | ask | show | jobs
by kradeelav 1368 days ago
The real information would be what version of PS this was implemented in (my guess is CC) and to make sure you have the version right before it. :)
3 comments

I hit this back in ‘03 or ‘04.

This page confirms it was add in Photoshop CS (October 2003): https://gist.github.com/msikma/04bfae8670300a12c55937c3b61d6...

If I remember correctly, this feature was present when took a graphics art class using CS4 or CS5.

Edit: looks like the first CS. https://m.slashdot.org/story/42050

Wow, thank you for letting me know! 2004, that's much earlier than I expected...
The logic is local. Could patch it out in 30 minutes if they dont have any anti circumventions
The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.
Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?
You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc.

For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.

Everyone else has mentioned the easy part - replacing the function entry with "return not money"

The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.

> start with the error string - find it in the file

This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.

did you check DLLs?
I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.
JMP 0x"target"