.exe editing

Cupis · Post by **Cupis** » 18 Oct 2007, 13:11

Hey guys

i been working with some editing and tweaking of IRC , namely mirc, but i have been running into some problems.

I been using an application called PE Explorer and i been runing into problems recompiling the exe. first i thought i must have put in a bad value or something along those lines. but then i decided jsut to decomplie then recompile withought making any changes. what could be the problem?

is it could be i am missing a certain plugin, which that exe needs.

help would be much appreciation

Website · Post by **hamin_aus** » 18 Oct 2007, 13:58

The most likely explanation is that mIRC have used some sort of tool to protect their executable against decompilers.

If you read the user license agreement for mIRC you will see that they explicitly forbid the use of decompilers or any sort of reverse engineering of their software.

Edit: Having said that, there is nothing wrong with being curious about how a piece of software works, especially if you paid for it

Hex_Rated · Post by **Hex_Rated** » 18 Oct 2007, 15:03

If you read the user license agreement for mIRC you will see that they explicitly forbid the use of decompilers or any sort of reverse engineering of their software.

I think almost every EULA I have ever read has that clause in it. But to be honest, unless you steal something that's patented and sell it, you'll actually get away with ripping off their techniques and implementing them in your software. As long as you rewrite it and don't copy it byte for byte.

Website · Post by **hamin_aus** » 18 Oct 2007, 15:33

Sure, I have used decompilers and hex editors on many executables without necessarily having permission

Mostly just to alter certain functionality, or to make cosmetic changes to the layout....

Cupis · Post by **Cupis** » 18 Oct 2007, 21:15

Exactly what i have been doing. im making like a bot program and ii am just editing the files and stuff to make my mirc just a little more specific to my bot needs and cosmetics

but maybe its a new version that forbids exe editing. cause i know with the older ones it was working :/ but mainly im jsut learning more about these things

cause my end up goal would be to maybe write a whole new program but learning odd things hear and there.

nice becoming a moderator btw

defza · Post by **defza** » 19 Oct 2007, 10:23

If the program does a checksum of some sort on itself when it starts up, then changing any value in the exe will break it.

You then need to make the checksum "work out" again. Either adding extra stuff, or changing the checksum to the new value generated by the edited exe.

Hex_Rated · Post by **Hex_Rated** » 19 Oct 2007, 11:26

Send PHR33K a PM. He messes around with decompilers so maybe he can help you.

SBSP · Post by **SBSP** » 24 Oct 2007, 15:23

defza wrote:If the program does a checksum of some sort on itself when it starts up, then changing any value in the exe will break it.

You then need to make the checksum "work out" again. Either adding extra stuff, or changing the checksum to the new value generated by the edited exe.

Yes but he is not changing he is decompiling then recompiling. and it still wont work.
But could be what you said.

My guess is parts in the EXE is encrypted like most games. Then recompiling again its messed up.

I once opened BF2's EXE with in a decompiler and it told me straigh please close and open decompilers while launching the EXE with in the decompiler

What Jamin sais i was curious

PHR33K · Post by **PHR33K** » 24 Oct 2007, 19:28

jamin_za wrote:The most likely explanation is that mIRC have used some sort of tool to protect their executable against decompilers.

If you read the user license agreement for mIRC you will see that they explicitly forbid the use of decompilers or any sort of reverse engineering of their software.

Edit: Having said that, there is nothing wrong with being curious about how a piece of software works, especially if you paid for it

Use OllyDbg rather than PE Explorer. You're probably messing the IAT up or something along those lines.

jamin_za wrote:The most likely explanation is that mIRC have used some sort of tool to protect their executable against decompilers.

mIRC doesnt have any such protection. I would say what I've done with my mIRC client... but its probably against the forum rules to promote cracking.

jamin_za wrote:Edit: Having said that, there is nothing wrong with being curious about how a piece of software works, especially if you paid for it

Excuses Excuses!

haha