Skip to content

Instantly share code, notes, and snippets.

@trevor403
Last active January 4, 2023 03:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save trevor403/c4098eb4de01709657306375d17c61f6 to your computer and use it in GitHub Desktop.
Save trevor403/c4098eb4de01709657306375d17c61f6 to your computer and use it in GitHub Desktop.
A small patcher to bypass protected Lua functions in World of Warcraft 1.12.1 client `WoW.exe`
with open('WoW.exe', 'rb') as f:
b = bytearray(f.read())
def apply_patch(name, search, patch):
print("PATCHING", name)
size = len(patch)
orig = search[:size]
if b.count(search) != 1:
print("not a good patch", b.count(search))
exit(1)
offset = b.index(search)
found = bytes(b[offset:offset+size])
if found != orig:
print("error, instruction not found")
exit(1)
print("ORIG", found)
print("NEW", patch)
b[offset:offset+size] = patch
name = "Skip protected check"
search = b'\x0f\x84\xb1\x00\x00\x00\x68\x90\x00\x00\x00'
patch = b'\xe9\xe1\x00\x00\x00\x90' # kstool x32 'jmp 0x00494b40; nop' 00494a5a
apply_patch(name, search, patch)
name = "Enable logging a"
search = b'\x74\x14\x8b\x86\x18\x01\x00\x00'
patch = b'\x90\x90' # kstool x32 'nop; nop' 0065aca2
apply_patch(name, search, patch)
name = "Enable logging b"
search = b'\x74\x14\x8b\x96\x18\x01\x00\x00'
patch = b'\x90\x90' # kstool x32 'nop; nop' 0065a771
apply_patch(name, search, patch)
with open('WoW-unprotected.exe', 'wb') as f:
f.write(b)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment