debug diag caused binary changes, bytes were moved

[hookedatwallacom]

Hi all,

Someone was trying to set a debug diag rule on our process, after 2 days, the process was changed.

The .exe of my software was changed, The first 2 bytes (0,1) were changed with other (12,13).
This has caused to not load/execute correctly.

Here is a screenshot of binary comparison.
Who would do this? Left is original, Right is the modified version.

4D 54 was replaced with FF FF



Can debugdiag cause it?

Continue reading...