WizTree patch

Mar 5, 2025    #reverse-engineering  

WizTree is a powerful disk space analyzer.

You should support the author here .

Let’s Play

Patching WizTree is quite easy.

Nopping the je instruction below is enough.

000000000135B0B7            | E8 349DC1FF                    | call wiztree64.F74DF0                            |
000000000135B0BC            | 85C0                           | test eax,eax                                     |
000000000135B0BE            | 0F94C0                         | sete al                                          |
000000000135B0C1            | 8885 C1010000                  | mov byte ptr ss:[rbp+1C1],al                     |
000000000135B0C7            | 80BD C1010000 00               | cmp byte ptr ss:[rbp+1C1],0                      |
000000000135B0CE            | 0F84 4A080000                  | je wiztree64.135B91E                             |
000000000135B0D4            | 66:83BD C4010000 00            | cmp word ptr ss:[rbp+1C4],0                      |
000000000135B0DC            | 0F86 40020000                  | jbe wiztree64.135B322                            |
000000000135B0E2            | 66:B9 D907                     | mov cx,7D9                                       |
000000000135B0E6            | 66:BA 0100                     | mov dx,1                                         |
000000000135B0EA            | 6641:B8 0100                   | mov r8w,1                                        |

Oh, it has self-verification.

Nop it or write a hijack DLL like me.

Patch

Warning

For test purposes only!

7z password: 543210.

7z SHA-256: AE7CE2535187921AE2B3AA3DCE6AA84DDA341EE8A4D3FD0C55799A2FEA73BFCA.

How to Use

  1. Install Wiztree .
  2. Unpack the patch archive.
  3. Move oleacc.dll next to WizTree64.exe.
  4. Restart the program WizTree64.exe.