1

I am new to reverse engineering so this seems like a very basic issue, and still I was not able to find an answer to it myself yet. Hopefully someone can point me in the right direction.

I am on Windows, I disassembled an exe file using "PE Explorer". For now, my process was to somehow, mostly by trial and error, identify the machine code steps I want to change in the dissasembly, then make the necessary change by opening the same exe in a hex editor, finding the same instruction and changing it there.

(Side note here: This two step process is quite inefficient. Is there a program you can recommend where I can combine both steps in one go, or at least side by side?)

While this has worked for me so far, I believe there must be a better way than doing this by trial and error and manually trying to identify the functions in the machine code. Is there? Particularly, is there a way to run a program (exe) and in parallel follow the steps in the dissasembly (ideally slowed down..)?

Thank you.

Improve this question
2
  • Use a debugger like OllyDbg which can patch executables.
    – 0xec
    Oct 16, 2015 at 13:18
  • cdb -c "bp $exentry;g" <yourexe> or windbg -Q -c "bp $exentry;g" <your exe" will break on WinMainCrt . etc etc (the Address of Entry point in PeHeader)
    – blabb
    Oct 16, 2015 at 13:53

1 Answer 1

Reset to default
1

Particularly, is there a way to run a program (exe) and in parallel follow the steps in the dissasembly (ideally slowed down..)?

Yes, the type of tool you're describing is called a "debugger".

Some popular debuggers for Windows are:

There are plenty of others, but these are some of the most user-friendly.

Improve this answer
2
  • Thanks Jason. Will one of those allow me to make direct changes in the machine code and save back to the same exe? Also, which is your personal favorite?
    – vic
    Oct 16, 2015 at 14:44
  • OllyDbg v2.01 allows it. You can use an extra plugin for IDA Pro to allow it. Not sure about x64dbg since I so rarely use it. As for my personal favorite, it depends on the requirements. For user-mode x86 debugging on Windows, I use OllyDbg. For user-mode x64 debugging on Windows, I use x64dbg. For kernel-mode debugging on Windows and for user-mode and kernel-mode debugging on non-Windows platforms, I use IDA Pro's debugger.
    – Jason Geffner
    Oct 16, 2015 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.