[peterg70]

Hey all

I have a program that is capable of detecting when i patch a DLL due to axprotect codemeter wrapper.

the file is also digitally signed.

When i searched around on internet I found a similar patch was done on the same file but it is not detected as modified.
When I compared the files I noticed 20 bytes has been modified.
If I attempt to change one of these new values the file is detected as modified again.

So somehow the cracker has managed to make the hash check for the DLL to pass by changing the 20 bytes.

Does anyone know of a program that calculates the old hash and then works out what is needed to make the patched dll pass the same hash

thanks