readdict
October 22nd, 2005, 23:24
An additional note in case any of you operate in a 64-bit environment.. There is a identical timezone check, the evil russian gmt one, in ida64.wll as well.
When you reverse ida.wll and apply your permanent patch solution, take note of the opcodes starting from the MOV ECX,0E10 instruction up until the conditional JLE instruction. The code in ida64.wll is identical as far as this part goes so you can use this set of opcodes to search & replace the check inside ida64.wll too.
If you for some reason would like to poke around at this code location and want to find it quickly I'd suggest you use ollydbg and load the wll as a dll file. A very useful option indeed, especially when you can't get the file to load during runtime due to lack of a 64-bit os. With the wll loaded in memory you could search for the unique set of opcodes in memory and find the codes address location.
Or you could use a more generic approach that would work when encountering similar checks, but each with their unique set of instructions, apart from i.e. the api used.
Analyze the file (or Ollydbg won't find all the "referenced to" of your target locations), then go fetch its Imports and find GetTimeZoneInformation. Select "Find references to import" and you'll find two references, of which one calls the api, follow this reference in the cpu (disassembler) window.
When you are located in the codeflow that calls GetTimeZoneInformation then "Go to previous procedure" (ctrl+minus) to get to the top of this branches codeflow. With the very first instructions selected, use "Find references to selected command" (ctrl+r) and you'll find two references here and only one of them is CALLing here, follow this ref.
And so you have arrived at the timezone check location.
What was ment to be a small notice about ida64.wll turned out to be a small chapter instead.
