Skip to main content

Questions tagged [exe]

Use this tag when referring to a true .EXE file as opposed to a .COM or .MSI or any other executable.

Filter by
Sorted by
Tagged with
0 votes
0 answers
40 views

How do I force IDA to reload PE Header and/or segments?

Introduction I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
Kyuuri's user avatar
  • 1
0 votes
0 answers
39 views

How to embed PE files to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
0 votes
0 answers
38 views

How do I modify Windows 98's "SETUP.EXE" file?

I'm currently trying to make a mod of Windows 98. I successfully modified the autorun.exe file, but now, I'm trying to edit setup.exe, and I've run into some problems. I first tried it in Resource ...
TOWF's user avatar
  • 1
3 votes
0 answers
136 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
TyCobb's user avatar
  • 131
0 votes
0 answers
152 views

Retrieve hardcoded string in WinDev compiled app

I wrote an application with WinDev allowing you to open encrypted PDFs without the user having to enter or know the password. This of course only works with PDFs that I have encrypted myself, always ...
deltonio2's user avatar
2 votes
2 answers
201 views

How can I extract *.c file hidden in an executable file (SkiFree)

I am a person interested of old games (MS DOS and 16 bit Windows only) and programming. In 2020, I saw an article about hacking SkiFree somewhere on the internet and soon as I followed the ...
Picaboo3's user avatar
3 votes
0 answers
131 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
DertliSelo's user avatar
4 votes
0 answers
1k views

Finding older IDA files

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64. On the graph view it is only showing the main ...
securityauditor's user avatar
2 votes
1 answer
70 views

why some functions push data before the prologue

i am a newbie in the world of RE , i start to explorer a main entry of a classic game from 90's and i start to see something confuse me as a newbie this main entry function start with pushing stuff to ...
0x00001F's user avatar
1 vote
1 answer
115 views

How can I add a menu to an executable file that does not have one?

I am just reverse-engineering an application I made for fun but since it doesn't have a menu. How can I add one? I tried using IDA pro but no hope, same with OllyDbg.
Picaboo3's user avatar
1 vote
0 answers
139 views

Reversing Assembly Code (ASM) to Extract Password (Pin)

I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
Анатолий Городничий's user avatar
0 votes
0 answers
179 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
Louis Vanhove's user avatar
0 votes
0 answers
107 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
Nur1's user avatar
  • 101
3 votes
1 answer
3k views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
Earldridge Jazzed Pineda's user avatar
1 vote
1 answer
3k views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
T-Regex's user avatar
  • 121
3 votes
2 answers
1k views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
Nqndi's user avatar
  • 35
0 votes
0 answers
262 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero's user avatar
0 votes
0 answers
205 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
LucaG's user avatar
  • 1
0 votes
1 answer
114 views

FINDING & EXECUTING a function from an exe/dll (not compiled by me)?

my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting. On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
Alexander Mehler's user avatar
0 votes
1 answer
2k views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
Daros911's user avatar
  • 115
0 votes
3 answers
2k views

How to extract machine code from a file(especially executable) in C

How to get machine code of a file(mainly executables) in C? I have written a C program to convert machine code to assembly. But how to get machine code of a file? How would I go about programming a c ...
BleepLogger's user avatar
0 votes
1 answer
828 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
The epic face 007's user avatar
-1 votes
2 answers
220 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
almost_somebody's user avatar
0 votes
1 answer
74 views

Force a firmware updater to flash any drive model

For a self-learning project, I want to patch an exe file. I have a firmware updater (exe file) that updates a 20-year old DVD drive (Matsushita model SW-9586-T). I own a commercial version of the ...
Vincent's user avatar
  • 101
2 votes
1 answer
874 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
Ranganatha Rao's user avatar
1 vote
1 answer
1k views

How to create executable (create build) from original decompiled exe?

I have reverse engineered exe file using pyinstxtractor.py script. There were around 1120 files in PYZ archive. F:\Python Test>python pyinstxtractor.py test.exe [*] Processing test.exe [*] ...
RS Gamer's user avatar
1 vote
1 answer
1k views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
RS Gamer's user avatar
3 votes
1 answer
239 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
Patrik Staron's user avatar
0 votes
1 answer
4k views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...
g319909.nwytg.coM's user avatar
3 votes
1 answer
383 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
g319909.nwytg.coM's user avatar
4 votes
3 answers
2k views

How to run part of exe file that is being reversed

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it. How can I run an exe file from a specific ...
g319909.nwytg.coM's user avatar
0 votes
1 answer
2k views

(ILSpy) System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid

How to overcome the error message while trying to open the exe in ILSpy: System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid. at Mono.Cecil.PE.ImageReader....
T.Todua's user avatar
  • 653
1 vote
1 answer
3k views

I want to decompile a exe and change the code to not need Admin to run

I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with: <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" ...
Schreyer Karl's user avatar
12 votes
2 answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
GoldenWest's user avatar
11 votes
3 answers
4k views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
Jason's user avatar
  • 113
1 vote
1 answer
581 views

Why doesn't IDA break on the WriteFile function?

I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them. But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
Keystone's user avatar
  • 523
3 votes
1 answer
406 views

Catch connection string between exe and mdb

I have an exe file that read and write from a local DB file. I checked this file with Detect It Easy and it shows that this is a mdb file. I can open this file with microsoft access, and watch all ...
Keystone's user avatar
  • 523
3 votes
1 answer
4k views

How to see all my comments on idb file

I add some comments to exe file with ida(save on idb). Is there any simple way how to see all my comments in 1 windows?
Keystone's user avatar
  • 523
2 votes
0 answers
1k views

Dump c++ class definitions from .exe + .pdb on windows

Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using gdb but haven't had any luck doing this on windows. I've tried ...
Marik's user avatar
  • 21
1 vote
0 answers
529 views

Decompiling or modifying .exe file generated from .jar

I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
Koce Dqnkov's user avatar
3 votes
1 answer
3k views

How to change the strings in rdata section of a executable file?

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). It has an rdata section (read-only data section) that include many (several thousand) strings of ...
Ramin Bateni's user avatar
0 votes
1 answer
498 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
user3621843's user avatar
2 votes
1 answer
196 views

Help reading a variable from an address in an executable?

** Edit ** After some great help from @tylernygaard I have discovered that the same variable is being written to two difference places in the memory. They are both 'static' addresses. Problem solved. ...
John T's user avatar
  • 167
3 votes
1 answer
5k views

Is it possible to extract / read a variable out of a running .exe file?

I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
John T's user avatar
  • 167
-2 votes
1 answer
579 views

Crack an executable in PE [closed]

So I noticed that I can write something in PE from the executable For example if I write 1911 he tells me [!]Cracked By RAZOR 1911 But if I write something else it will not tell me anything. What ...
Filipe Barros's user avatar
0 votes
1 answer
2k views

Trying To Read Code From Call of Duty [closed]

Before I begin I want to say for whatever reason the site wouldn't let me post this unless I didn't have the coding so I just linked it instead of it being here. This is most likely the most stupid ...
xFlarp's user avatar
  • 31
-2 votes
1 answer
429 views

EXE Encryption Techniques

Are there any tutorials available for learning how to do encryption of an EXE ? I am particular interested on how it decrypt's itself and runs in memory. If there are any tutorials or post that ...
Heidi's user avatar
  • 1
0 votes
2 answers
12k views

How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay] [closed]

when i input .exe file to PEiD v0.95 it gives output like "Borland Delphi 6.0 - 7.0 [Overlay]" Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.
Sam's user avatar
  • 21
0 votes
1 answer
2k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
DaveTheMinion's user avatar
1 vote
0 answers
3k views

How to turn a .dll file into a .exe file for ollydbg?

I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears : File 'C:\..........\Conficker.exe' is a ...
user3097712's user avatar
  • 1,541