View Full Version : Patched program runs under OllyDbg, when saved to disk it crashes

March 22nd, 2012, 06:52
Hey all,

I've been trying to patch one program which checks for license at startup. I managed to bypass all nags and made the program to work. But, it only works when I load it in OllyDbg, patch and run under OllyDbg. When I try to save changes to file (tried via OllyDbg and HIEW), program executes fine, without nag screens, but after 3-10 seconds of it's executing it crashes.

What bothers me is that it runs fine in OllyDbg when I patch it, but when I save changes to disk, it crashes after some time. Also, when I load patched app under OllyDbg, it crashes there too. So basically, it works fine only when changes are in-memory, and not saved on disk.

There are two patches that I do in code, and none is changing .exe size. One is just changing JE SHORT address1 to JMP SHORT address2, and other is NOP-ing 6 bytes JG instruction.

I've also tried to fix IAT with ImpREC, but then it crashes right at the start.

Can anyone give me a hint how to resolve this ? Thanks!

March 22nd, 2012, 07:31
Ok, it's definitely integrity check. I edited unused byte with HIEW and it crashed.

March 22nd, 2012, 21:38
do you mind PMing the name of the proggie to me?

March 23rd, 2012, 00:41
If it can be patched:

1. Based on address (OR)
2. Based on searchable bytes

Then you can create a run time loader (run time memory patch) for it.

Alternatively, you'll have to jump the integrity check.

Have Phun,

March 23rd, 2012, 03:39
Yea, I created run-time patcher (loader).

But it has more checks apparently, now it won't work whats it's supposed to do, when I click on Start, it creates thread but thread does nothing. jop, I'll send you pm now.

March 24th, 2012, 05:00
Well, it probably runs patched in olly because the changes are in memory, and the program doesn't verify those.
..:: Thinking Harder... ::..