-----------------------------------------------------------
                   Process Patcher v3.60

              (C) 1999-2000 thewd@hotmail.com
-----------------------------------------------------------

1.  Overview / Filelist
2.  Disclaimer
3.  Usage
4.  System Requirements / Recommendations
5.  Format of Configuration File (Example)
6.  Description of Configuration Parameters
7.  Release History
8.  Known Bugs
9.  Future Versions
10. Contact Information

-----------------------------------------------------------
1.  Overview / Filelist
-----------------------------------------------------------

- ppatcher.exe  // process patcher executable
- ppatcher.ppc  // configuration file example
- readme.txt    // this readme file
- examples.zip  // demonstration examples

This is a great (and original) command-line tool that allows
a Win32 application to be patched during its runtime execution.

This procedure might be required because the executable may
be compressed or encrypted and known unpackers fail to
decompress or decrypt the executable to a runnable form.

Also, as this tool doesn't change the stored executable, all
CRC checks performed on this executable will succeed.

You can encrypt the configuration file using the RC4 algorithm
(use /encrypt argument)
This gives limited protection to the configuration file and
stops unauthorised persons from using your patch

Note: using the /default argument (with /encrypt) encrypts
      the configuration file using the default key and while
      providing limited protection also allows the patch to be
      executed without the user suppling a decryption key

-----------------------------------------------------------
2.  Disclaimer
-----------------------------------------------------------

The author is not responsible for any damage caused by the
use of this Process Patcher.
It was tested successfully on Windows 9x, NT4 & 2000
USE AT YOUR OWN RISK!

-----------------------------------------------------------
3.  Usage
-----------------------------------------------------------

To run the process patcher, type 'ppatcher' from the
directory containing 'ppatcher.ppc', or by double-clicking
the configuration file (.ppc) from the Windows Explorer

Note: if the configuration file name is not 'ppatcher.ppc'
      use the /config parameter to specify the actual name
      (from command prompt)

All the settings needed to patch the application are taken
from the configuration file.

- '/config <filename>' specify the file name of the
  configuration file if different from 'ppatcher.ppc'

- '/wait' will make this tool wait until the process is idle
  before patching. This may be required if the process is
  patched before being fully initialised

- '/displayinfo' will display patch information which includes
  author and contact information (if available)

- '/shell' will register the extension .ppc as a file type.
  Double-clicking on the configuration file will execute this
  tool and run the patch. You can also edit the configuration
  file, by selecting 'Edit...' from the menu

- '/noshell' will unregister the file type extension .ppc

- '/debug' display extended information during the patching process

- '/encrypt' encrypts the configuration file using the key
  supplied

   Note: The encryption key can be up to 16 characters
         The encryption key is case-sensitive.
         No Key = No Decryption, so make sure you either keep
         a backup copy or remember the key

-----------------------------------------------------------
4.  System Requirements / Recommendations
-----------------------------------------------------------

Microsoft Windows 95 / 98 / Millennium / NT4 / 2000
Microsoft Internet Explorer 4 (with Desktop Update)
Pentium Processor (or equivalent)

-----------------------------------------------------------
5.  Format of Configuration File (Example)
-----------------------------------------------------------

#Process Patcher Configuration File
Version=3.60

PatchInformation=Test Program that demonstrates basic patching
PatchAuthor=thewd
PatchContactInformation=thewd@hotmail.com

DisplayName=My Test Program
Filename=test.exe
Filesize=363818
Arguments=/quiet
WaitInfinite=true
SupportedPlatforms=Win98, Win2000
Address=0x402368:0x55:0xB0
Address=0x402369:0x8B:0x01
Address=0x40236A:0xEC:0xC3

[Module 1]
Filename=test.dll
Address=0x004322:0x12:0x00

[Module 2]
Filename=test2.dll
IsDynamic=true
Address=0x001000:0x00:0x20
Address=0x0089A3:0x75:0xEB

#End of Configuration File

Notes:

- Don't alter the headings as they are used by the parsing
  engine

- The main program that will be executed is included first,
  followed by additional modules (if required).
  DisplayName and Filename are compulsory.

  [Module ??] contains the additional module(s) to be patched.
  Only Filename is compulsory. The memory address listed here
  are not the absolute address but the offset. If the DLL
  module is loaded dynamically, then use the
  IsDynamic=true parameter

  All others properties are optional extras!
  Note: supports up to 5 modules

- Version control has been introduced since v2.5 and determines
  the minimum version the process patcher must be for full
  operation (optional)

- The format of the patching routine is...
  <memory address>:<original byte>:<new byte>

  The byte codes can be both decimal or hexadecimal. Hexadecimal
  codes must be preceded with the prefix '0x', as shown above

Able to parse the following entries...
- PatchInformation            (&)
- PatchAuthor                 (&)
- PatchContactInformation     (&)

- Version                     (&)
- SupportedPlatforms          (&)
- StealthMode                 (&)

- DisplayName             (*)     (+)
- Filename                (*)     (+) (~) (@) (#)
- Filesize                        (+)
- Arguments                       (+)         (#)

- Address                         (+)     (@)
- RetryCount                      (+)     (@)

- CreatesChildProcess             (+)
- WaitInfinite                    (+)     (@)
- UserNotify                      (+)
- IsDynamic                               (@)
- ImpersonateUser                 (+)

Note: (*) - Compulsory Parameters
      (&) - Global Parameters
      (+) - Valid in Process Section only
      (~) - Valid in Child Process Section only
      (@) - Valid in Module Sections only
      (#) - Valid in Plugin Sections only

-----------------------------------------------------------
6.  Description of Configuration Parameters
-----------------------------------------------------------

[GLOBAL PARAMETERS]

- PatchInformation, information about what the patch does
                    e.g. PatchInformation=Accepts any serial number

- PatchAuthor, author of the patch
               e.g. PatchAuthor=thewd

- PatchContactInformation, information on how to contact the author
                           e.g. PatchContactInformation=thewd@hotmail.com

- Version, the minimum version the Process Patcher needs to
           be for the patch to work fully
           e.g. Version=3.60

- SupportedPlatforms, comma separated list that declares which
                      operating system platforms are supported
                      by this patch. Possible values...
                      Win95   \         \
                      Win98    - Win9x   \
                      WinMill /           \
                                          - All
                      WinNT4  \           /
                               - WinNTx  /
                      Win2000 /         /
                      e.g. SupportedPlatforms=Win98, WinNTx

- StealthMode, attempts to hide this process patcher from the target process
               on Windows 9x only
               e.g. StealthMode=true

[SECTION PARAMETERS]

- DisplayName, a name that represents the application to be
               patched
               e.g. DisplayName=Test Application

- Filename, the name of the main application to be executed
            or a module used by the main application
            (if used within a module section)
            e.g. Filename=test.exe or Filename=test.dll

- Filesize, the file size of the main application. Could be
            used to check that the patch is applied to the
            correct verion
            e.g. Filesize=542331

- Arguments, arguments to be forwarded to the application
             e.g. Arguments=/silent /nowarn

- RetryCount, the number of re-patches on the memory locations
              e.g. RetryCount=5

- Address, there can be zero or more of these statements and
           contains details of the patch to be performed.
           The format of the patch is...
           <memory address>:<original byte>:<new byte>
           e.g. Address=0x402000:0x74:0xEB

- WaitInfinite, wait as long as possible before attempting to
                patch the application
                e.g. WaitInfinite=true

- UserNotify, displays a message box which the user closes when
              the patch is to be applied
              e.g. UserNotify=true

- IsDynamic, only applicable in the module section, and is used
             when patching modules that are dynamically linked
             e.g. IsDynamic=true

- ImpersonateUser, run the process under the security context of
                   another user with all the permissions that
                   user has (Windows 2000 Only)

- CreatesChildProcess, supports applications that creates a child
                       process which is actually the main application
                       e.g. CreatesChildProcess=true

Note:
-  CreatesChildProcess parameter can either be defined as above, in
   which case the first child process found is patched, or it can be
   define in its own section, e.g.
   
   [Child Process]
   Filename=childprocess.exe

   (See Creates Child Process And Module Example)

-----------------------------------------------------------
7.  Release History
-----------------------------------------------------------

v3.60 (29/01/2000)
- Full Windows 2000 support
- Increased Parsing & Patching Engine robustness
- Added patch information parameters - PatchInformation,
  PatchAuthor and PatchContactInformation
  Information is accessed by using the /displayinfo argument
  (this is an attempt to stop people bugging me about patches
   that don't work and were not written by me)
- Added RetryCount parameter which determines the number of
  times the memory patch is attempted
- Introduced StealthMode parameter, which attempts to hide
  this process patcher from the target process (Windows 9x Only)
- so many other internal enhancements

v3.30 (01/11/1999)
- supports a plugin architecture (beta)
- updated parsing engine to support SupportedPlatforms and
  ImpersonateUser parameters
- updated and faster parsing and patching engine with better
  error handling
- introduced /default argument for use with the /encrypt option.
  Creates an encrypted configuration file with the default
  key. This allows the patch to be run without user intervention
- no longer need psapi.dll module when executing on Windows NT4
- many other updates and enhancements
- better Windows 2000 (RC3 Beta) support

v3.20 (04/10/1999)
- provided greater support for Windows NT4
- fixed a number of new bugs introduced since v3.x

v3.10 (16/09/1999)
- added UserNotify and CreatesChildProcess parameters to
  parsing engine
- updated documentation to give details of every parameter
  supported by the parsing engine

v3.00 (01/09/1999)
- configuration file has a new format (no longer supports
  the older format)
- new faster parsing engine
- new faster patching engine
- can patch statically & dynamically linked libraries loaded
  or used by the process (Beta Engine)
- no longer need add-on utility to encrypt configuration
  files, as it's now built-in (using /encrypt parameter)
- Blowfish encrypted configuration files are no longer supported.
- Added Encrypt option to shell extension .ppc

v2.50 (26/06/1999)
- version control introduced
- fixed small bugs
- updated the parsing engine
- updated the registered shell extension .ppc
  (run ppatcher /shell to update registry)

v2.40 (24/04/1999)
- added support for configuration files with a name other than
  'ppatcher.ppc' (/config <filename>)
- the configuration file now supports hexadecimal numbers as
  well as decimal numbers,
  i.e. 
        0x402368 (in hexadecimal)
        4203368  (in decimal)
- minor bug fixes
- renamed /idle option to /wait

v2.30 (15/03/1999)
- small bug fixes

v2.20 (02/03/1999)
- automatically asks for decryption key if the configuration
  file is encrypted. No need to use /decrypt
- removed /decrypt option
- updated Blowfish Component DLL

v2.10 (22/01/1999)
- rewrote the process timing routine due to problems with
  patching when anti-virus software is running and scanning
  the system

v2.0 (18/01/1999)
- added support for encrypted configuration files
- created an add-on utility that can encrypt the configuration
  file

v1.60 (17/01/1999)
- changed the default configuration file extension from .cfg
  to .ppc
- can register (/shell) and unregister (/noshell) a file type
  association to the extension .ppc

v1.50 (09/01/1999)
- added version and icon resources

v1.40 (05/01/1999)
- fixed timing bug under Windows NT 4.0
- updated the whole timing routine

v1.30 (04/01/1999)
- added command-line option which waits until the process is
  idle before patching bytes (/idle)
- updated documentation

v1.20 (03/01/1999)
- first public version
- changed the layout of the configuration file
- now supports patching to more than one memory location
- updated documentation (although it's still crap)
- fixed known bugs

v1.10 (03/01/1999)
- added support for command-line arguments
- fixed known bugs

v1.00 (02/01/1999)
- initial release

-----------------------------------------------------------
8.  Known Bugs
-----------------------------------------------------------

- The Process Patcher icons may not be displayed under
  Windows 95 without IE4+ (with Desktup Update) installed

-----------------------------------------------------------
9.  Future Versions
-----------------------------------------------------------

- any enhancements I can think of...
- any suggestions you think would be useful...

-----------------------------------------------------------
10. Contact Information
-----------------------------------------------------------

Send any suggestions or bugs to thewd@hotmail.com.
You can obtain the latest version of this tool from...

http://surf.to/thewd
http://come.to/thewd
http://protools.cjb.net

-----------------------------------------------------------
-----------------------------------------------------------
