Questions tagged [exe]
Use this tag when referring to a true .EXE file as opposed to a .COM or .MSI or any other executable.
47
questions
0
votes
0
answers
21
views
Reverse DLL and EXE at the same time?
I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
- 101
0
votes
0
answers
113
views
Retrieve hardcoded string in WinDev compiled app
I wrote an application with WinDev allowing you to open encrypted PDFs without the user having to enter or know the password.
This of course only works with PDFs that I have encrypted myself, always ...
- 51
2
votes
2
answers
165
views
How can I extract *.c file hidden in an executable file (SkiFree)
I am a person interested of old games (MS DOS and 16 bit Windows only) and programming. In 2020, I saw an article about hacking SkiFree somewhere on the internet and soon as I followed the ...
- 31
3
votes
0
answers
118
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
3
votes
0
answers
561
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 185
2
votes
1
answer
70
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 23
1
vote
1
answer
98
views
How can I add a menu to an executable file that does not have one?
I am just reverse-engineering an application I made for fun but since it doesn't have a menu. How can I add one?
I tried using IDA pro but no hope, same with OllyDbg.
- 19
1
vote
0
answers
121
views
Reversing Assembly Code (ASM) to Extract Password (Pin)
I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
0
votes
0
answers
130
views
Malware analysis of undetected NodeJS token grabber
I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'.
Someone contacted me asking to playtest a game, which prompted a .exe file.
I ran the file and website on ...
0
votes
0
answers
103
views
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
- 101
3
votes
1
answer
3k
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
1
vote
1
answer
3k
views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
- 21
3
votes
2
answers
864
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
0
votes
0
answers
212
views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0
answers
176
views
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).
The problem now is on a Windows program. I start it ...
- 1
0
votes
1
answer
103
views
FINDING & EXECUTING a function from an exe/dll (not compiled by me)?
my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting.
On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
0
votes
1
answer
2k
views
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
- 115
0
votes
3
answers
1k
views
How to extract machine code from a file(especially executable) in C
How to get machine code of a file(mainly executables) in C?
I have written a C program to convert machine code to assembly. But how to get machine code of a file? How would I go about programming a c ...
- 11
0
votes
1
answer
699
views
What are the way I can reverse engineer an obfuscated C++ program?
I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
-1
votes
2
answers
188
views
How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)
I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
0
votes
1
answer
70
views
Force a firmware updater to flash any drive model
For a self-learning project, I want to patch an exe file.
I have a firmware updater (exe file) that updates a 20-year old DVD drive (Matsushita model SW-9586-T).
I own a commercial version of the ...
- 101
2
votes
1
answer
780
views
Start vs WinMain()
I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
- 141
1
vote
1
answer
1k
views
How to create executable (create build) from original decompiled exe?
I have reverse engineered exe file using pyinstxtractor.py script.
There were around 1120 files in PYZ archive.
F:\Python Test>python pyinstxtractor.py test.exe
[*] Processing test.exe
[*] ...
- 21
1
vote
1
answer
1k
views
How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?
I have decompiled exe using pyextractor script and generated
these files:
PYZ-00.pyz
PYZ-00.pyz_extracted
gui
pyi_rth_tkinter
pyi_rth_multiprocessing
pyi_rth_pkgres
pyi_rth_win32comgenpy
...
- 21
3
votes
1
answer
213
views
Certain bytes in the memory (RAM) get changed after the program starts. Why?
I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
- 131
0
votes
1
answer
3k
views
How to export function from exe file?
I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.
How can I export function that I Know the name ...
3
votes
1
answer
345
views
How to wrap dump process and execute it in another PC
I debug exe file in Ida , and put breakpoint in some address.
I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
4
votes
3
answers
2k
views
How to run part of exe file that is being reversed
I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it.
How can I run an exe file from a specific ...
0
votes
1
answer
2k
views
(ILSpy) System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid
How to overcome the error message while trying to open the exe in ILSpy:
System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid.
at Mono.Cecil.PE.ImageReader....
- 643
1
vote
1
answer
2k
views
I want to decompile a exe and change the code to not need Admin to run
I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with:
<requestedPrivileges>
<requestedExecutionLevel
level="requireAdministrator"
...
12
votes
2
answers
3k
views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
- 135
11
votes
3
answers
4k
views
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger?
I've been thinking of ...
- 113
1
vote
1
answer
532
views
Why doesn't IDA break on the WriteFile function?
I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them.
But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
- 523
3
votes
1
answer
376
views
Catch connection string between exe and mdb
I have an exe file that read and write from a local DB file.
I checked this file with Detect It Easy and it shows that this is a mdb file.
I can open this file with microsoft access, and watch all ...
- 523
3
votes
1
answer
3k
views
How to see all my comments on idb file
I add some comments to exe file with ida(save on idb).
Is there any simple way how to see all my comments in 1 windows?
- 523
2
votes
0
answers
958
views
Dump c++ class definitions from .exe + .pdb on windows
Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using gdb but haven't had any luck doing this on windows. I've tried ...
- 21
1
vote
0
answers
524
views
Decompiling or modifying .exe file generated from .jar
I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
- 11
3
votes
1
answer
3k
views
How to change the strings in rdata section of a executable file?
I'm a programmer and have an application (an executable file that maybe compiled from a c++ source).
It has an rdata section (read-only data section) that include many (several thousand) strings of ...
- 131
0
votes
1
answer
463
views
Change URL a program sends data to
I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names.
I tried to use a debugger and checked for the URL it ...
- 11
2
votes
1
answer
167
views
Help reading a variable from an address in an executable?
** Edit ** After some great help from @tylernygaard I have discovered that the same variable is being written to two difference places in the memory. They are both 'static' addresses. Problem solved. ...
- 167
3
votes
1
answer
5k
views
Is it possible to extract / read a variable out of a running .exe file?
I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
- 167
-2
votes
1
answer
556
views
Crack an executable in PE [closed]
So I noticed that I can write something in PE from the executable
For example if I write 1911 he tells me
[!]Cracked By RAZOR 1911
But if I write something else it will not tell me anything. What ...
0
votes
1
answer
2k
views
Trying To Read Code From Call of Duty [closed]
Before I begin I want to say for whatever reason the site wouldn't let me post this unless I didn't have the coding so I just linked it instead of it being here.
This is most likely the most stupid ...
- 31
-2
votes
1
answer
427
views
EXE Encryption Techniques
Are there any tutorials available for learning how to do encryption of an EXE ? I am particular interested on how it decrypt's itself and runs in memory.
If there are any tutorials or post that ...
- 1
0
votes
2
answers
11k
views
How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay] [closed]
when i input .exe file to PEiD v0.95 it gives output like
"Borland Delphi 6.0 - 7.0 [Overlay]"
Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.
- 21
0
votes
1
answer
2k
views
Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?
I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
- 191
1
vote
0
answers
3k
views
How to turn a .dll file into a .exe file for ollydbg?
I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears :
File 'C:\..........\Conficker.exe' is a ...
- 1,531