Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Like if I want to patch a function in a PE.
Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original code to link up there but is there a better way?
I don't know, maybe some way to export the binary to ASM files which then I could compile back with GCC.
Because like I want to make big changes to the binary - I'm thinking of parallelizing a part of the code. Thanks.
To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).
Then, you'll only need to patch calls to your modified or new functionality functions. Either by first editing the Import Table or by dynamically loading your DLL using LoadLibrary and functions using GetProcAddress.
Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse engineered a program back to compilable source. This project took way too long.
If your changes were minor, I would recommend codecaving. Just create a PE section jump to it and make your changes , then jump back. Tutorial on how to expand PE binary
I have done this before on large projects. And Usually a good clean approach is to use DLL injection.
You can just make your functions to over write parts of the .exe and have your functions take place. I will post a few examples as well as a youtube series which goes into decent detail on what to do.
I will let you know that these methods can be dangerous and require administrator privileges to inject into the process.
