[DiscordArchive] after binary patching, what brakes?
[DiscordArchive] after binary patching, what brakes?
Archived author: Fabian • Posted: 2023-03-10T16:42:03.947000+00:00
Original source
That does not apply to wow
Archived author: ZaDarkSide • Posted: 2023-03-10T16:42:27.562000+00:00
Original source
i know, but, the basic gist of packing is you have a small loader that unpacks the PE in memory right? because you can't run encrypted stuff in memory because in memory you need to run actual instructions unless it's a virtual machine that's running some custom bytecode
Archived author: Fabian • Posted: 2023-03-10T16:44:23.660000+00:00
Original source
you have many little encrypted parts in wow. some also get overwritten with trash code before reaching the actual entry point of the game. Any changes u do on the unpacked dump will also result in triggering some integrity checks etc.
Archived author: Fabian • Posted: 2023-03-10T16:44:41.349000+00:00
Original source
those things are all done before/while wow is getting unpacked, saved etc.
Archived author: Fabian • Posted: 2023-03-10T16:44:46.221000+00:00
Original source
for wow this is not really an option
Archived author: Fabian • Posted: 2023-03-10T16:45:33.014000+00:00
Original source
that decrypter that guy is talking about leaves those parts alone and only seem to decrypt the big .text part that contains the game code
Archived author: Fabian • Posted: 2023-03-10T16:46:21.014000+00:00
Original source
Due to the crc/integrity checks being initialized while unpacking all of those are also still fine and working properly with the re encryption
Archived author: ZaDarkSide • Posted: 2023-03-10T16:47:13.907000+00:00
Original source
yeah anyway it's a huge file, i guess 90% of it is junk code or something
Archived author: Fabian • Posted: 2023-03-10T16:48:12.122000+00:00
Original source
more like 40%