Patches not saving 0/x

[SniperHero007]

So, I've been searching around and didn't find any working solution for my problem. The problem I have is pretty self explanatory (title). Is there any way to fix this problem? Anything else I could attach to understand my problem?

[mrexodia]

This should be in the FAQ. You cannot patch something that does not exist on disk.

…

On Tue, 5 Mar 2019 at 21:17, SniperHero ***@***.***> wrote: So, I've been searching around and didn't find any working solution for my problem. The problem I have is pretty self explanatory (title). Is there any way to fix this problem? Anything else I could attach to understand my problem? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2135>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACWCmUXRDHFWsOta7SpUQr6qoJnYlqkvks5vTtDYgaJpZM4bfaus> .

[SniperHero007]

Here, I made a screenshot... It exists because when I change it right before the exe want to go there, it works, but the patch doesn't...

[mrexodia]

My guess, the code is put there at runtime. Check the section table in a pe editor and see if that section has a raw address + size. If it does there is a bug in x64dbg. Otherwise it’s just the same story: you cannot patch something that does not exist on disk.

[SniperHero007]

I'm sorry, I'm new to this, what program should I use and how should I do this?

[mrexodia]

Cff explorer works. I recommend watching some malware analysis videos about pe unmapping to get up to speed.

…

On Tue, 5 Mar 2019 at 23:15, SniperHero ***@***.***> wrote: I'm sorry, I'm new to this, what program should I use and how should I do this? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2135 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACWCmdgVPZPEOFlKqeaG5-xqH0TLSXXpks5vTuyagaJpZM4bfaus> .

[SniperHero007]

Does this mean it has?

[mrexodia]

http://faq.x64dbg.com

[MahdiJamal]

I had the same problem, then I realized that the program was compressed with upx

After decompressed and tested again, the problem was solved