5 ms·

The real information would be what version of PS this was implemented in (my guess is CC) and to make sure you have the version right before it. :)

flatiron 4y ago
The logic is local. Could patch it out in 30 minutes if they dont have any anti circumventions
- rootw0rm 4y ago
  The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.
  - dopeboy 4y ago
    Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?
    - coretx 4y ago
      JMP 0x"target"
    - rootw0rm 4y ago
      You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc. For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.
    - kaszanka 4y ago
      The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
    - rsaxvc 4y ago
      Everyone else has mentioned the easy part - replacing the function entry with "return not money" The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.
      - Double_a_92 4y ago
        > start with the error string - find it in the file This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.
        flatiron 4y ago
        did you check DLLs?
      - ottello 4y ago
        I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
    - ale42 4y ago
      Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.
Cerium 4y ago
If I remember correctly, this feature was present when took a graphics art class using CS4 or CS5. Edit: looks like the first CS. https://m.slashdot.org/story/42050 https://m.slashdot.org/story/42050
- kradeelav 4y ago
  Wow, thank you for letting me know! 2004, that's much earlier than I expected...
tobyjsullivan 4y ago
I hit this back in ‘03 or ‘04. This page confirms it was add in Photoshop CS (October 2003): https://gist.github.com/msikma/04bfae8670300a12c55937c3b61d670a https://gist.github.com/msikma/04bfae8670300a12c55937c3b61d6...

flatiron 4y ago

The logic is local. Could patch it out in 30 minutes if they dont have any anti circumventions

rootw0rm 4y ago
The first x64 patch I ever did was to remove this very protection from Photoshop years ago. It was a single instruction patch, 1-3 bytes changed, I don't remember exactly.
- dopeboy 4y ago
  Curious, as I'm totally oblivious to this - how does one patch a closed source binary to get around this protection?
  - coretx 4y ago
    JMP 0x"target"
  - rootw0rm 4y ago
    You use your favorite reversing tools. IDA, Ghidra, x64dbg, binary ninja, etc. For this particular example, Photoshop, an error message is displayed for currency detection. The first thing I would do is load up the executable and look for that particular string. If I'm lucky and there aren't many protections for the executable, I'll be in the right area for figuring out what to patch, or I'll at least know which code paths to start tracing.
  - kaszanka 4y ago
    The single instruction patch mentioned in the parent comment is probably changing a conditional jump (for example JE - jump if equal) into an unconditional jump, or a NOP (no operarion) instruction that does nothing, depending on if the jump leads into code we want to run or not.
  - rsaxvc 4y ago
    Everyone else has mentioned the easy part - replacing the function entry with "return not money" The hard part is finding where that is. One approach is to start with the error string - find it in the file and put a memory-read breakpoint on it in the debugger. Trigger the error and capture the call stack - start working up the chain until you identify why that text was read, either the failure directly or a message passed to that thread - if it's a message, find what sent it and why.
    - Double_a_92 4y ago
      > start with the error string - find it in the file This has never ever worked for me, unless it was some prepared example. There just never are any meaningful strings in the EXE.
      - flatiron 4y ago
        did you check DLLs?
    - ottello 4y ago
      I'm trying to disassemble photoshop CS4 wish me good luck because it seems they pretty hide it
  - ale42 4y ago
    Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.

Cerium 4y ago

If I remember correctly, this feature was present when took a graphics art class using CS4 or CS5. Edit: looks like the first CS. https://m.slashdot.org/story/42050 https://m.slashdot.org/story/42050

kradeelav 4y ago
Wow, thank you for letting me know! 2004, that's much earlier than I expected...

tobyjsullivan 4y ago

I hit this back in ‘03 or ‘04. This page confirms it was add in Photoshop CS (October 2003): https://gist.github.com/msikma/04bfae8670300a12c55937c3b61d670a https://gist.github.com/msikma/04bfae8670300a12c55937c3b61d6...