Hello and welcome back.
In this video, I'm going to show you how to patch files.
So we'll open the crackme.
And you search for the bad string.
Right-click,
Search for, Current module, String references.
And the bad string is wrong.
I'll be wrong, so just double-click on it to head over to that address in memory where the string is
found.
Now we scroll up and look for the start of the function, which is push -.
We right-click and we graph it.
As we have seen before,
whether or not this jump goes to the left or to the right depends on the compare operation
here.
So if the comparison shows that - is the same as 42, then it will go to the right.
If the comparison shows that - and 42 is not the same, then it goes to the left.
So JNE means jump not equal.
That means - is not equal to 42.
Now if we want to reverse the jump, we must convert this JNE to become jump equal, JE.
So if it's jump equal, it means that whenever the password is same as 42, whenever - is the same as
42, then it will go and jump to the left.
But if the password is, - is not the same as 42, then it will jump to the right and show a good message.
So this is how we reverse the logic just by reversing the jump.
So in order to reverse the jump, first we put a comment here.
Right-click, put a comment.
You can also use semicolon to put a comment.
And then type the comment to remind yourself that I'm supposed to convert this to JE.
So this is how normally I do it.
So after you have put your comment there, then you have to head back to the assembly view in order
to patch it, in order to convert this to JE.
So what you can do is right-click here and follow in disassembler.
And there you see JE is over there.
So now over here you can just convert this to JE by pressing spacebar.
Press spacebar,
and then make sure you check this box here and this box and this box.
And then you remove the N, then click Okay.
Now make sure the instructions are the same size.
If it is bigger, then it will fail because it will overwrite the next byte.
Currently it needs two bytes.
So JE and JNE are both occupying just two bytes.
Just click Okay, and you are done.
So now you can patch this.
Go to File, Patch file.
Click Patch File and let's give it a new name, crackme_1, and click Save.
Now we can close this and run the patch directly
from here.
So let's key in any wrong password.
Hit Enter, and notice it shows you a good message.
So this is how we can use a patch to reverse the jump.
That means no matter what password you enter, it will still show you the good message.
All right, so this is called a surface patch because we did not analyze very deep into the reason why
it is showing good or bad messages.
We just patch the first jump we can reverse.
So in future lessons, we will look at more details,
how to do deep patching, where we have to analyze in a deep manner by entering the calls and so
on to analyze why it is jumping left or showing good message or showing a bad message or jumping
to the right, and so on.
So that's all for this video.
Thank you for watching.