Can you change the executable?
Posted: Mon Oct 31, 2011 3:41 am
I was curious about this as I was reviewing what I know about certain games that have certain stops or checks.
Something like this appears in Ollydbg:
Now, call me crazy but if possible I'd like to replace that with another call in kernel32 that would always return false. And also, if possible I'd like to change it in the executable so I don't have to deal with a lengthy proccess every time.
There's actually a list of these functions I'd like to go through and change. In my head it seemed as though I could change the function calls in the running program itself without changing offsets or data positioning. If that's so then can't you just change the executable like that, and if so - how would you do that?
Something like this appears in Ollydbg:
Code: Select all
00E3436C FF15 00400801 CALL DWORD PTR DS:[<&KERNEL32.IsDebugger>; kernel32.IsDebuggerPresent
There's actually a list of these functions I'd like to go through and change. In my head it seemed as though I could change the function calls in the running program itself without changing offsets or data positioning. If that's so then can't you just change the executable like that, and if so - how would you do that?