Hacker News new | ask | show | jobs
by rootw0rm 1373 days ago
The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.
1 comments

Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?
You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc.

For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.

Everyone else has mentioned the easy part - replacing the function entry with "return not money"

The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.

> start with the error string - find it in the file

This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.

did you check DLLs?
I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.
JMP 0x"target"