Can you change the executable?

[MiesterMan]

I was curious about this as I was reviewing what I know about certain games that have certain stops or checks.

Something like this appears in Ollydbg:

Code: Select all

00E3436C   FF15 00400801    CALL DWORD PTR DS:[<&KERNEL32.IsDebugger>; kernel32.IsDebuggerPresent

Now, call me crazy but if possible I'd like to replace that with another call in kernel32 that would always return false. And also, if possible I'd like to change it in the executable so I don't have to deal with a lengthy proccess every time.

There's actually a list of these functions I'd like to go through and change. In my head it seemed as though I could change the function calls in the running program itself without changing offsets or data positioning. If that's so then can't you just change the executable like that, and if so - how would you do that?

[Administrator]

Just change the address. The address dictates which module it is coming from. You could also insert your own function into a blank region and use that.

After you've made your changes, right-click the CPU window and go to Copy to executable -> all modifications -> Copy all. Now a new window will pop open, and you will right-click it, go to Copy -> To file. Now you can just run this modified executable directly.