[Release / tutorial] Edit exe so aloken can fish

[kurmiz]

Originally Posted by Ultimo ☼

Recently i've decided to mess around with my exe to learn something.. and i've noticed that "Error" in SkadadIller's client codes.
Idk what FISHALOK. mean but i know you have to delete it to make it working.

I said it already, its his Exe file's name (FISHALO___.exe)
rename your exe into 'candy.exe', and it will show 'JMP candy.000000'
You allways need to need remove word from Push/jmp/...
Well, yes he forgot to delete it while copying/pasting for leechers ^^

P.S. Thanks for tutorial

[Ultimo ☼]

Originally Posted by kurmiz

I said it already, its his Exe file's name (FISHALO___.exe)
rename your exe into 'candy.exe', and it will show 'JMP candy.000000'
You allways need to need remove word from Push/jmp/...
Well, yes he forgot to delete it while copying/pasting for leechers ^^

P.S. Thanks for tutorial

I dont think this is true.. my exe is named "dekaron_test_01.exe" and my code looks like "push dekaron_.xxxxx" and it still work correctly.

i think its "dekaron_.xxxxxx" because of this:



Its not about how you rename your dekaron.exe!
i'm noob to exe editing, i could be wrong.

[HellSpider]

Originally Posted by Ultimo ☼

I dont think this is true.. my exe is named "dekaron_test_01.exe" and my code looks like "push dekaron_.xxxxx" and it still work correctly.

i think its "dekaron_.xxxxxx" because of this:



Its not about how you rename your dekaron.exe!
i'm noob to exe editing, i could be wrong.

The identifier is just the first 8 characters of your filename. It changes when the filename changes. It's only what OllyDbg shows to indicate in which module the code is, it isn't visible in the code itself (it's just an address). And yes, the string must be removed if you wanna edit it, PUSH CONST, JMP CONST...

[gcleffff]

Hi thanks for the tutorial..

i cant seem to get it working your tutorials says
00475755 >-E9 924A7700 JMP 00A93000

but in my exe says
00475755 E9 A6D86100 JMP 00A93000

is this the cause that my exe is not working?
everytime i change the E9 A6D86100 to E9 924A7700, it turns the JMP 00A93000 to this JMP 00BEA1EC


Sorry for this im a noob