Aqui hay un code para parchear un fichero
Lo he traducido de un codigo en Delphi, para mas Info mirar en los comentarios
Lo he provado con el OllyDbg v1 y da errores.. pero con el OllyDbg BETA lo carga sin problemas
Código
'--------------------------------------------------------------------------------------- ' Module : mNoOlly ' Author : Karcrack ' DateTime : 18/01/2009 00:41 ' Purpose : AntiOlly ' Reference : http://hackhound.org/forum/index.php?topic=8387.0;topicseen ' ' Thanks : Cobein, for his ChangeOEP code :D '--------------------------------------------------------------------------------------- Option Explicit Private Const IMAGE_DOS_SIGNATURE As Long = &H5A4D& Private Const IMAGE_NT_SIGNATURE As Long = &H4550& Private Const SIZE_DOS_HEADER As Long = &H40 Private Const SIZE_NT_HEADERS As Long = &HF8 Private Const SIZE_SECTION_HEADER As Long = &H28 Private Type IMAGE_DOS_HEADER e_magic As Integer e_cblp As Integer e_cp As Integer e_crlc As Integer e_cparhdr As Integer e_minalloc As Integer e_maxalloc As Integer e_ss As Integer e_sp As Integer e_csum As Integer e_ip As Integer e_cs As Integer e_lfarlc As Integer e_ovno As Integer e_res(0 To 3) As Integer e_oemid As Integer e_oeminfo As Integer e_res2(0 To 9) As Integer e_lfanew As Long End Type Private Type IMAGE_FILE_HEADER Machine As Integer NumberOfSections As Integer TimeDateStamp As Long PointerToSymbolTable As Long NumberOfSymbols As Long SizeOfOptionalHeader As Integer characteristics As Integer End Type Private Type IMAGE_DATA_DIRECTORY VirtualAddress As Long Size As Long End Type Private Type IMAGE_OPTIONAL_HEADER Magic As Integer MajorLinkerVersion As Byte MinorLinkerVersion As Byte SizeOfCode As Long SizeOfInitializedData As Long SizeOfUnitializedData As Long AddressOfEntryPoint As Long BaseOfCode As Long BaseOfData As Long ImageBase As Long SectionAlignment As Long FileAlignment As Long MajorOperatingSystemVersion As Integer MinorOperatingSystemVersion As Integer MajorImageVersion As Integer MinorImageVersion As Integer MajorSubsystemVersion As Integer MinorSubsystemVersion As Integer W32VersionValue As Long SizeOfImage As Long SizeOfHeaders As Long CheckSum As Long SubSystem As Integer DllCharacteristics As Integer SizeOfStackReserve As Long SizeOfStackCommit As Long SizeOfHeapReserve As Long SizeOfHeapCommit As Long LoaderFlags As Long NumberOfRvaAndSizes As Long DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY End Type Private Type IMAGE_NT_HEADERS Signature As Long FileHeader As IMAGE_FILE_HEADER OptionalHeader As IMAGE_OPTIONAL_HEADER End Type Private Type IMAGE_SECTION_HEADER SecName As String * 8 VirtualSize As Long VirtualAddress As Long SizeOfRawData As Long PointerToRawData As Long PointerToRelocations As Long PointerToLinenumbers As Long NumberOfRelocations As Integer NumberOfLinenumbers As Integer characteristics As Long End Type Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Dest As Any, Src As Any, ByVal L As Long) Public Function PatchFile(ByRef bFile() As Byte) As Byte() Dim IDH As IMAGE_DOS_HEADER Dim INH As IMAGE_NT_HEADERS Call CopyMemory(IDH, bFile(0), SIZE_DOS_HEADER) If IDH.e_magic = IMAGE_DOS_SIGNATURE Then Call CopyMemory(INH, bFile(IDH.e_lfanew), SIZE_NT_HEADERS) If INH.Signature = IMAGE_NT_SIGNATURE Then INH.OptionalHeader.DataDirectory(0).VirtualAddress = &H1000 INH.OptionalHeader.DataDirectory(0).Size = &HF000 Call CopyMemory(bFile(IDH.e_lfanew), INH, SIZE_NT_HEADERS) PatchFile = bFile End If End If End Function
Saludos