Hey all,

I've been trying to patch one program which checks for license at startup. I managed to bypass all nags and made the program to work. But, it only works when I load it in OllyDbg, patch and run under OllyDbg. When I try to save changes to file (tried via OllyDbg and HIEW), program executes fine, without nag screens, but after 3-10 seconds of it's executing it crashes.

What bothers me is that it runs fine in OllyDbg when I patch it, but when I save changes to disk, it crashes after some time. Also, when I load patched app under OllyDbg, it crashes there too. So basically, it works fine only when changes are in-memory, and not saved on disk.

There are two patches that I do in code, and none is changing .exe size. One is just changing JE SHORT address1 to JMP SHORT address2, and other is NOP-ing 6 bytes JG instruction.

I've also tried to fix IAT with ImpREC, but then it crashes right at the start.

Can anyone give me a hint how to resolve this ? Thanks!

Ok, it's definitely integrity check. I edited unused byte with HIEW and it crashed.

do you mind PMing the name of the proggie to me?

If it can be patched:

1. Based on address (OR)
2. Based on searchable bytes

Then you can create a run time loader (run time memory patch) for it.

Alternatively, you'll have to jump the integrity check.

Have Phun,

Yea, I created run-time patcher (loader).

But it has more checks apparently, now it won't work whats it's supposed to do, when I click on Start, it creates thread but thread does nothing. jop, I'll send you pm now.

Well, it probably runs patched in olly because the changes are in memory, and the program doesn't verify those.
..:: Thinking Harder... ::..