| Random user and pw protected console app |
2x replace JZ with JMP
Steps I've done:
1) open downloaded binary in Ghidra debugger.
2) search "User_not_recognized." All fields
3) pressed Ctrl+E (show decompliler) and analyzed FUN_140019fa0
4) noticed two if/else for user/password ... thats where patches should be applied
user bypass
replace CTRL+SHIFT+G (Patch intstruction)
14001a0cb 74 74 JZ LAB_14001a141
with
14001a0cb eb 74 JMP LAB_14001a141
password bypass
replace CTRL+SHIFT+G (Patch intstruction)
14001a18e 0f 84 81 JZ LAB_14001a215
00 00 00
with
14001a18e 48 e9 81 JMP LAB_14001a215
00 00 00
Done
Export modified exe and run =)
gist version here https://gist.github.com/madzohan/e2ded5e8c912782df21dbe8bc3dba287
|