|
CreateFileA, the mother of all self-checks
as you know, nearly every program which uses a self-check on file (on harddisc, not in ram) needs to use the API CreateFileA to open it.
so my question: is it a good solution, first to create a copy of the file called <originalexe>.dat
and then do in the exe following:
hook the API CreateFileA
the hook does
Check if CreateFileA is used on main-exe
if used on main-exe, patch <originalexe>.exe in memory to <originalexe>.dat
then call real CreateFileA
so the program would think every CRC is ok because it checked the original file.
|