looking for a patcher

Discussion in 'other software & services' started by mantra, Jul 31, 2021.

  1. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    Hi

    i'm looking for a patcher mostly free that can compare 2 files and create a patcher
    maybe with the possibility to search and replace some strings

    i use a 64bit hex editor , but it's boring and i have always to do manually

    i need to make some tests for firewall and antivirus and other

    is there a free patcher or trial/paid patcher that can help me ?

    thanks
     
  2. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,871
    geez, this is ancient.
    - codefusion wizard 3.0 (from 1999), still working, very convenient, lot of options, search&replace, patterns

    i dropped any other tru time.
    be aware that patching effects possible digital certs or self checks.
     
  3. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    hi
    there is only codefusion wizard 3.0 , nothing more recent ?
    need the patch looking for a pattern and change it with my pattern
    the pattern could be in a different offet
    have you clean link for codefusion wizard 3.0 ? from softpedia i got several malware in the past ,might you check please?

    by the way i'm running just a test with codefusion wizard 3.0 , some programs are fooled by a simple patch

    thanks
     
    Last edited: Jul 31, 2021
  4. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,871
    no, that was the last build, but to remember - it is still working like charm.
    "offset", use search and replace
    i wonder that you wont find something based on your ability to patch files.

    exe hash: be4e29c67c273881086b4947d951dea5

    eg
    https://webscene.ir/tools/show/CodeFusion-Wizard-3.0
    https://webscene.ir/questions/show/what-is-the-password
     
  5. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    Hi
    it does give me lots of error ,and make some exe not working , can't run them
    but thanks for the link and the hash
    would like to send a pm ,but i can't
    thanks
     
  6. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,871
    and those are?
    if search&replace is not unique enough this can happen aside the other mentioned issues above.

    or you have used "replace all" instead "replace first match".

    in case of entering hex values 00 01 02 03 04 ... you should use (click) the "Pattern Find&Replace" button instead the oridinary.

    machines are dumb as bread, i know about decompiling and finding patches, but to tell a patcher the right place is a bit more work to do, in special you need to give exact boundaries. example

    it is not enough to tell to patch "00 01 02 03 04" to "04 03 02 01 00" when it exist more than once. to need to look for boundaries to limit:

    "ff fe 00 01 02 03 04 fe ff" is different from "fe ff 00 01 02 03 04 fe ff"
    so you need to work with a hex editor and copy out all hex blocks from all versions/builds you want to patch and look for differences. so you may find a lot of

    "ff fe 00 01 02 03 04 fe ff"

    but only one

    "aa ff fe 00 01 02 03 04 fe ff bb" which is right while the others are
    "cc ff fe 00 01 02 03 04 fe ff bb"
    "aa ff fe 00 01 02 03 04 fe ff cc"
    "cc ff fe 00 01 02 03 04 fe ff dd"

    in case of
    "aa ff fe 00 01 02 03 04 fe ff bb"
    the bold varies you can use
    "aa ?? fe 00 01 02 03 04 fe ?? bb"

    to get
    "aa ?? 04 03 02 01 00 fe ?? bb"

    (where "Pattern Find&Replace" is mandatory instead of the ordinary)
     
  7. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    Hi @Brummelchen
    can i ask you what hex editor do you use ?
    i'm using nexus HxD 2.5 free and portable
    what i don't like about it , and i really need is select and copy offset base and use to search
    do you know an hex editor that let me do it ? I have several several tabs opened with an exe for each tab
    i would like to copy and to use go to -> on the other tab
    thanks
    https://i.imgur.com/5uv0yts.png
     
  8. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,871
    i use winhex. are those offsets or values?

    i give you an example
    Code:
    #1AD0
    558BEC6AFF6808385E0064A100000000506489250000000083EC0853565733DB8965F08BF153895DFCE82250050083C4043BC374638D4DECE8735C0D008D4DEC
    55 8B EC 6A FF 68 08 38 5E 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 53 56 57 33 DB 89 65 F0 8B F1 53 89 5D FC E8 22 50 05 00 83 C4 04 3B C3 74 63 8D 4D EC E8 73 5C 0D 00 8D 4D EC
    55 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 53 56 57 33 DB 89 65 F0 8B
    C3 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 53 56 57 33 DB 89 65 F0 8B
    ^^
    
    
    #1C70
    558BEC6AFF6868385E0064A100000000506489250000000083EC3853565733F68965F0894DE0568975FCE8814E0500A14C966B0083C4048945E8A13CE16B00C6
    55 8B EC 6A FF 68 68 38 5E 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 38 53 56 57 33 F6 89 65 F0 89 4D E0 56 89 75 FC E8 81 4E 05 00 A1 4C 96 6B 00 83 C4 04 89 45 E8 A1 3C E1 6B 00 C6
    55 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 38 53 56 57 33 F6 89 65 F0 89 (61902)
    C3 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 38 53 56 57 33 F6 89 65 F0 89 (61902)
    ^^
    
    
    #282F0
    558BEC6AFF68C9665E0064A100000000506489250000000081ECC80A0000A19C3E690053565733F68BF93BC68965F0897DA88975FC0F85BF010000B90C000000
    55 8B EC 6A FF 68 C9 66 5E 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC C8 0A 00 00 A1 9C 3E 69 00 53 56 57 33 F6 8B F9 3B C6 89 65 F0 89 7D A8 89 75 FC 0F 85 BF 01 00 00 B9 0C 00 00 00
    55 8B EC 6A FF 68 ?? ?? 5E 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? 0A 00 00 A1 (61902)
    C3 8B EC 6A FF 68 ?? ?? 5E 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? 0A 00 00 A1 (61902)
    ------------------^^-^^-------------------------------------------------------^^
    55 8B EC 6A FF 68 59 09 5F 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC C8 0A 00 00 A1 (62107)
    55 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? 0A 00 00 A1
    C3 8B EC 6A FF 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC ?? 0A 00 00 A1
    ------------------^^-^^-------------------------------------------------------^^
    
    
    #42E54 #42E5F #42E61 #42E71
    8B F8 83 C4 04 89 7D EC 8B 45 EC 85 C0 74 0A
    33 FF 83 C4 04 89 7D EC 8B 45 EC 33 C0 EB 0A
    ^^-^^----------------------------^^----^^
    8B F8 83 C4 04 89 7D EC 8B 45 EC 85 C0 74 0A C7 05 D0 BE 6B 00 01 00 00 00 8B 45 EC 83 F8 07 (b10)
    8B F8 83 C4 04 89 7D EC 8B 45 EC 85 C0 74 0A C7 05 D0 BE 6B 00 01 00 00 00 8B 45 EC 83 F8 07 (b10)
    8B F8 83 C4 04 89 7D EC 8B 45 EC 85 C0 74 0A C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 F8 07 (b10)
    33 FF 83 C4 04 89 7D EC 8B 45 EC 33 C0 EB 0A C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 FF 07
    ^^-^^----------------------------^^----^^-------------------------------------------^^-^^-^^
    8B D8 83 C4 04 89 5D EC 8B 45 EC 85 C0 74 0A C7 05 60 E2 6B 00 01 00 00 00 8B 45 EC 83 F8 07 (61908)
    8B D8 83 C4 04 89 ?? EC 8B 45 EC 85 C0 74 0A C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 F8 07
    31 DB 83 C4 04 89 ?? EC 8B 45 EC 33 C0 EB 0A C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 FF 07 <-- Achtung ebx ab .08
    ^^-^^----------------------------^^----^^-------------------------------------------^^-^^-^^
    8B D8 83 C4 04 89 5D EC 8B 45 EC 85 C0 74 0A  C7 05 60 CE 6C 00 01 00 00 00 8B 45 EC 83 F8 07 77 (62119)
    8B D8 83 C4 04 89 5D EC 8B 45 EC 85 C0 74 0A  C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 F8 07 77
    31 DB 83 C4 04 89 5D EC 8B 45 EC 33 C0 EB 0A  C7 05 ?? ?? ?? 00 01 00 00 00 8B 45 EC 83 FF 07 77
    ^^-^^----------------------------^^----^^---  ---------------------------------------^^-^^-^^
    
    #4CE00
    5F 5E 5B 8B E5 5D C3 89 5D E0 EB 04 85 C0 74 6D 6A 00 (unreal)
    5F 5E 5B 8B E5 5D C3 89 5D E0 EB 71 85 C0 74 6D 6A 00
    ---------------------------------^^
    
    ^^ marks the patch
    first row without spaces is from winhex, with space is the format codefusion needs. (search&replace)

    these values (grabbed by winhex) contain changes over several builds, patch is always the same, but the rest is different for some bytes - those are marked as ?? because they are not important.

    as you can see the length varies. this is necessary to get a unique position in the concerned file(s), the patcher grows with the builds - from one to several and maybe future.

    (that project was dropped 6 years ago)
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.