Patch to C:\Program
Files\Sublime Text 3\sublime_text.exe
The keystrokes I actually
used:
1. Copy sublime_text_orig.exe
over sublime_text.exe and verify it is asking for "Update available"
2. Start
x96dbg and choose x64 and then load sublime.exe. Remember to suspend AutoHotkey
3. Rt. Click, Search for,
Current Module, String References, "Update Available"
4. Double
Click on "Update Available"
5. Press
F2 to set breakpoint or delete breakpoint. Watch the bottom left of the x96dbg
window
6. Threads,
Double Click, Main
7. Shift+F9
to run and ignore Exceptions -- Look for the Download Window, it may
be hidden or behind the Debug window or behind the Sublime window.
8. (Sublime
3 Should load)
9. Change
instruction at 00007FF7A3929F23 to je 0x00007FF7ED909F50 by clicking on
00007FF7A3929F23 and pressing space bar.
10. It will probably be
necessary to copy instruction from address 00007FF7A3929F2F because when pasted
it will do relative addressing and it will change the 74 14 to 74 2B.
11. Patch file
12. Restart(Ctrl+F2) - This
terminates the debugged process and reloads it.
13. Use F8 to trace
through the program. F8 allows me to execute an
entire subroutine or repeat instruction without stepping through it instruction
by instruction.
je
0x00007FF7ED909F50
====
Lines
7 through 17 are the minimal work needed:
Line 7 x64dbg
Line 8 File,
Open, C:\Program Files\Sublime Text 3\sublime_text.exe
Line 9 Rt.
Click, Search for, Current Module, String References, "Update
Available"
Line
10 Double
Click on "Update Available"
Line
11 Press
F2 to set breakpoint
Line 12 Change
instruction at 00007FF7A3929F23 to je 0x00007FF7ED909F50 by clicking on
Line
13 00007FF7A3929F23 and
pressing space bar.
Line
14 It
will probably be necessary to copy instruction from address 00007FF7A3929F2F
because when
Line
15 pasted
it will do relative addressing and it will change the 74 14 to 74 2B.
Line
16 Patch File.
====
Lines 7 through 17 are the minimal work needed.
Additional Notes.
Threads, Double Click, Main
Shift+F9
to run and ignore Exceptions -- Look for the Download Window, it may
be hidden or behind the Debug window or behind the Sublime window.
(Sublime
3 Should load)
Change instruction at 00007FF681689F23 to je
0x00007FF7ED909F50 by clicking on
00007FF681689F23
and pressing space bar.
Restart(Ctrl+F2): This terminates the debugged process and reloads it.
Remember
to Suspend AutoHotKey: So I
can use F8 to trace through the program. F8 allows me to execute an entire subroutine
or repeat instruction without stepping through it instruction by instruction.