Jump to content
Tuts 4 You
Sign in to follow this  
Shefo

x64dbg patching 0/x

Recommended Posts

Shefo

Hi there,

In x32dbg when i try to patch file it shows me 0/x patch(es) applied knowing that i try to change Jne to Jmp or adding mov al,1 to an empty byte as in these images 

x64dbg1.PNG

x64dbg2.PNG

x64dbg3.PNG

Share this post


Link to post
mrexodia

There can be various reasons for this. From the looks of it x64dbg cannot convert the VA to file offsets. This can be because of packing (eg your section has no raw size) or because of a bug in x64dbg.

  • Like 1

Share this post


Link to post
Shefo

Thanks for helping , but what should i do? if it is bugged? 

Share this post


Link to post
mrexodia

You could try to diagnose the VA to offset conversion. Can you find those instructions with something like CFF Explorer or a hex editor? I'm checking now with http://www.flightsimsoft.com/downloads/AS_PFPX_V126.exe but I'm not sure if that's the program you're looking at.

  • Like 1

Share this post


Link to post
mrexodia

Yeah so in your case the problem is that the section has no raw space at that point (it's packed with Themida):

vgVar1B.png

  • Like 1

Share this post


Link to post
Shefo

yes it is the same program but version 105 .

i tried to unpack it but when i open the unpacked one it tells me that the program maybe debugged or damaged and it doesn't open maybe i should rebuild imports? 

 

Edited by Shefo (see edit history)

Share this post


Link to post
Shefo

No it is not the same program unfortunately

Share this post


Link to post
Shefo

Do you know any good tutorial about Themida unpacking?

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...