I recently needed an application do to a formatted hard drive (I am not going to incriminate myself here). So with
x64dbg I downloaded the application and made it run the way it was intended to run and got all my data back..
I could not patch the application do to a CRC, which was just fine with me. I just kept the application in x64dbg.
The place where I patched the code I copied and kept for further references..(witch is below)
I opened the same application in x64dbg to investigate it a little further and to my surprise I could not go back to any of the
virtual addresses that I saved below. So I guess the program was mapped into a different memory address space.
So this brings me to the question!!. What should I have done differently so I could have gone back to any of the addresses below?
Also I made X64dbg brake on the DLL where I had patched earlier.and that is where i looked for the addresses.
00007FFDC50A1370 | E8 F375F0FF | call powerdatarecoveryui.7FFDC4FA8968 | go here to save files
00007FFDC509ADA4 | 0F84 FC000000 | je powerdatarecoveryui.7FFDC509AEA6 | This should jump
00007FFDC509ADA4 | 0F84 FC000000 | je powerdatarecoveryui.7FFDC509AEA6 | This should jump
00007FFDC509AEAD | 74 79 | je powerdatarecoveryui.7FFDC509AF28 | jump to save files
00007FFDCC7DD148 | 90 | nop
00007FFDCC7DD141 | 85C0 | test eax,eax |
00007FFDCC7DD143 | 74 09 | je partitionwizard.7FFDCC7DD14E | partition ID jumps
00007FFDCC7DD145 | 83F8 66 | cmp eax,66
00007FFDCC7DD149 | 90 | nop |
00007FFDCC7DD14A | 90 | nop | NOP JUMP JMP
00007FFDCC7DD14B | 90 | nop |
00007FFDCC7DD14C | 90 | nop
|
Thanks brentab
x64dbg I downloaded the application and made it run the way it was intended to run and got all my data back..
I could not patch the application do to a CRC, which was just fine with me. I just kept the application in x64dbg.
The place where I patched the code I copied and kept for further references..(witch is below)
I opened the same application in x64dbg to investigate it a little further and to my surprise I could not go back to any of the
virtual addresses that I saved below. So I guess the program was mapped into a different memory address space.
So this brings me to the question!!. What should I have done differently so I could have gone back to any of the addresses below?
Also I made X64dbg brake on the DLL where I had patched earlier.and that is where i looked for the addresses.
00007FFDC50A1370 | E8 F375F0FF | call powerdatarecoveryui.7FFDC4FA8968 | go here to save files
00007FFDC509ADA4 | 0F84 FC000000 | je powerdatarecoveryui.7FFDC509AEA6 | This should jump
00007FFDC509ADA4 | 0F84 FC000000 | je powerdatarecoveryui.7FFDC509AEA6 | This should jump
00007FFDC509AEAD | 74 79 | je powerdatarecoveryui.7FFDC509AF28 | jump to save files
00007FFDCC7DD148 | 90 | nop
00007FFDCC7DD141 | 85C0 | test eax,eax |
00007FFDCC7DD143 | 74 09 | je partitionwizard.7FFDCC7DD14E | partition ID jumps
00007FFDCC7DD145 | 83F8 66 | cmp eax,66
00007FFDCC7DD149 | 90 | nop |
00007FFDCC7DD14A | 90 | nop | NOP JUMP JMP
00007FFDCC7DD14B | 90 | nop |
00007FFDCC7DD14C | 90 | nop
|
Thanks brentab