21
Developer's Corner / How to remove CRC check from a exe?
« on: January 02, 2009, 03:12 PM »
Anyone has some tips to remove CRC check from exe.
I have a exe which has is_debug_present and some assembly which I had to change. But now when I run that program I get some error “error unpacking program”. I think the exe has some internal CRC check.
Problems while remove CRC:
1. I think the error string shown is generated at runtime, so I cannot find from memory map and put BP
2. I cannot see any references to show window, msgbox etc.
Anyone can provide some tips to fight these anti-reverse eng ticks.
I am using the latest ollydbg-200i, which has very good support for putting memory point anywhere (old ollydbg gives problem if I put breakpoint in some memory areas)
I have a exe which has is_debug_present and some assembly which I had to change. But now when I run that program I get some error “error unpacking program”. I think the exe has some internal CRC check.
Problems while remove CRC:
1. I think the error string shown is generated at runtime, so I cannot find from memory map and put BP
2. I cannot see any references to show window, msgbox etc.
Anyone can provide some tips to fight these anti-reverse eng ticks.
I am using the latest ollydbg-200i, which has very good support for putting memory point anywhere (old ollydbg gives problem if I put breakpoint in some memory areas)