K
K
kacejot2017-12-27 23:39:50
reverse engineering
kacejot, 2017-12-27 23:39:50

How to remove function call in exe by patching it?

My goal is to disable TLSCallback in order for the debugger to work.
I need to patch the code, not bypass the callback.
actual code:

.text:00401AA0 TlsCallback_0   proc near               ; DATA XREF: .rdata:TlsCallbacks↓o
.text:00401AA0                 jmp     TlsCallback_0_0
.text:00401AA0 TlsCallback_0   endp

Expected code:
.text:00401AA0 TlsCallback_0   proc near               ; DATA XREF: .rdata:TlsCallbacks↓o
.text:00401AA0 TlsCallback_0   endp

Answer the question

In order to leave comments, you need to log in

1 answer(s)
R
Rou1997, 2017-12-28
@kacejot

So you need to watch what is returned in TlsCallback_0_0 .
If nothing, then simply replace the instruction from jmp to nop in the amount of 1 pc. (judging by the code, both weigh 1 byte).
In general, the question is taken out of context.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question