Giter VIP home page Giter VIP logo

Comments (4)

Ceiridge avatar Ceiridge commented on May 26, 2024

Yes, it can patch anything in the executable memory of chrome.dll. It first searches for the pattern, which should be unique. It consists of the assembled bytes of the function's assembly instructions with other addresses and changing values as wildcards.
Once the pattern is found, a patch is applied at a given offset (can be 0, so it is directly overwritten where the pattern has been found). Normally, only one byte is patched, but you can also enter multiple assembled x86 instruction bytes (for example:

xor rax, rax
ret

to return false, as seen in the Remove QR Code Availability Patch).
If you want to contribute a patch, you can do it like this. I would then also recommend reading the comments in the patterns.xml file, although they are annoying to understand

You can also use a local patterns.xml file by starting the patcher installer in debug mode, as far as I remember

from chrome-developer-mode-extension-warning-patcher.

HMaker avatar HMaker commented on May 26, 2024

@Ceiridge Great. So what means orig, patch, sig and sigOffset attributes of PatchData tag?

<Patch pattern="Remove QR Code Availability" group="5">
	<PatchData type="x64" orig="0xE9" patch="0x00" sig="true" sigOffset="0x0">
		<Offset>0x22</Offset> <!-- Offset to get to jmp + 1 -->
		<NewBytes>4831C0C3</NewBytes> <!-- xor rax, rax; ret; (= return 0;) -->
	</PatchData>
</Patch>

from chrome-developer-mode-extension-warning-patcher.

Ceiridge avatar Ceiridge commented on May 26, 2024

Type: x64 (x86-64). The patcher used to also support x86-32, so don't use x86
Orig: Original byte that should be replaced. 0xFF is a wildcard, so it would be ignored then. If the byte does not match, an error is thrown
Patch: The new byte
Sig: Is the pattern a signature? This is rather complicated to explain and it's very rarely used. It's sometimes more reliable to find an address of a function by searching for an instruction that has an address to it (for example call FunctionAddress). Then, if sig is enabled, it takes that address offset of the call instuction for example and calculates the right address.
SigOffset: If sig is enabled, this exact offset will be added to the followed address as explained above

Offset: This is added to the found pattern location, can also be 0x0
NewBytes: Optional, but this allows you to write multiple instructions easily. In this case: 0x48 31 C0 = xor rax, rax and 0xC3 = ret)

from chrome-developer-mode-extension-warning-patcher.

Ceiridge avatar Ceiridge commented on May 26, 2024

If you want to find out more about how signatures work (which I do not recommend) or something else in general: https://github.com/Ceiridge/Chrome-Developer-Mode-Extension-Warning-Patcher/blob/master/ChromePatcherDll/patches.cpp#L231

from chrome-developer-mode-extension-warning-patcher.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.