debug diag caused binary changes, bytes were moved

[Guest hookedatwallacom]

Hi all,

 

Someone was trying to set a debug diag rule on our process, after 2 days, the process was changed.

 

The .exe of my software was changed, The first 2 bytes (0,1) were changed with other (12,13).

This has caused to not load/execute correctly.

 

Here is a screenshot of binary comparison.

Who would do this? Left is original, Right is the modified version.

 

4D 54 was replaced with FF FF

 

 

Can debugdiag cause it?

 

Continue reading...