Questions tagged [executable]
A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains.
122
questions
1
vote
0
answers
19
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 123
2
votes
1
answer
57
views
Can #if DEBUG in C# become true in the released binary?
I have something like this in my code that checks for user's license:
// C# code:
#if DEBUG
MakeLicenseValidForever();
#else
CheckLicense();
#endif
Now, I need to know if these directives ...
- 123
1
vote
0
answers
57
views
How do I create a native app with Visual Studio 2022?
A few years ago, I built a Windows Native Application using the Build.exe command of the DDK.
The following site gives a better idea for W7 of what I had done:
https://prog.world/windows-native-...
- 51
0
votes
0
answers
31
views
Reversing Executable Package
I have an .exe file that loads some other files when executed, I need to redirect these files and export them. When debugging I know that there is a subfolder /images/%s.png where the files in ...
0
votes
0
answers
52
views
Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++
The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
- 21
0
votes
0
answers
100
views
How to locate executable section
How to locate executable section in PE file?
Is there any of typical way to locate executable section in any PE file?
- 101
3
votes
3
answers
463
views
Program doesn't load a custom .dll from main directory. How can i inject a .dll BEFORE the executable starts?
I want to use DXVK in GTA 5 on Windows 11.
Using the needed .dlls (d3d11.dll and dxgi.dll) and launching the game comes with this error
Using Process Explorer (while the error message is displayed) ...
0
votes
1
answer
1k
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
3
votes
1
answer
2k
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
2
votes
1
answer
1k
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
0
votes
1
answer
325
views
dnSpy works really slow. How can I fix it?
I've been doing some stuff with a pre-compiled .NET executable. It is my first time reversing something, so I don't know much.
I got a bunch of programs like ILSpy, dnSpy and dotPeek. They all do as ...
- 1
2
votes
1
answer
713
views
Change manifest file using ResourceHacker CLI
I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI.
I have managed to extract the resources ...
- 21
-2
votes
1
answer
86
views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
- 7
2
votes
0
answers
182
views
How can I extract working files (in the form of graphics) from these MZP executables?
There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
- 21
0
votes
2
answers
406
views
Pe file code starting address
When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
- 105
0
votes
3
answers
978
views
How to extract machine code from a file(especially executable) in C
How to get machine code of a file(mainly executables) in C?
I have written a C program to convert machine code to assembly. But how to get machine code of a file? How would I go about programming a c ...
- 11
2
votes
0
answers
239
views
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...
I have a .ipa file (iOS application) that I load into to Hopper Disassembler.
I search for a string to ...
- 21
0
votes
1
answer
331
views
Generating an elf header
To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
- 103
0
votes
0
answers
120
views
How is ELF symbol resolution and relocation different from PE symbol resolution?
I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE ...
- 1,738
0
votes
0
answers
47
views
static analysis for identifying backdoors
I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.
1.String search in .exe
2.find Reffrence .dll and win32 Api calls using import table
...
0
votes
1
answer
560
views
Replace string in hexa with a longer one in .bin without destroying the structure (in .data)
I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).
I managed to replace strings in hexadecimal with ...
- 15
1
vote
1
answer
4k
views
Decompiling Python Files: ValueError
So I have this python file and I successfully unpacked its content inside of it we have our file.pyc
I appended the magic bytes to it so it went from:
E3 00 00 00 00 00 00 00 00 00 00 00 00
to ...
- 31
-2
votes
1
answer
5k
views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
- 61
1
vote
1
answer
3k
views
Can "missing section headers" ELF files still be executed/dangerous?
On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info.
Also, when using the Python elftools library to parse them, exceptions will be thrown....
- 55
1
vote
1
answer
111
views
How to create an executable that keeps the same virtual address on different runs
I want to create an executable that keeps the same virtual address during different execution runs.
This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
- 113
4
votes
1
answer
10k
views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
- 141
1
vote
0
answers
99
views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
2
votes
2
answers
534
views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
- 23
0
votes
1
answer
120
views
Is there a way to reverse engineer this small tool "website2apk" and design my own? [closed]
I recently came across this tool and was amazed by its size and how it can build release-apk, without even bothering about Android development environment set up on the machine, neither Cordova nor ...
- 3
4
votes
1
answer
686
views
change PE file icon without re-signing the file all over again
Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
- 273
0
votes
0
answers
145
views
Which API function is responsible for input strings?
I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
- 1
1
vote
2
answers
424
views
How can I retrieve image files embedded/compressed in a MPL file?
There are some images hidden somewhere in a PE I have, I can't figure out how to extract them.
This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
- 21
1
vote
1
answer
259
views
Hex editing a program to change variable types
For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.
...
- 15
0
votes
0
answers
118
views
I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?
I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system.
Can I edit the code off the .exe file? I need to change a value in the code.
Thank ...
1
vote
1
answer
304
views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
- 125
11
votes
3
answers
3k
views
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger?
I've been thinking of ...
- 113
3
votes
1
answer
67
views
Are the names of COFF Data Directories fixed?
I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected.
The documentation says that this value can change (though I've ...
- 133
-3
votes
1
answer
977
views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
- 15
-1
votes
1
answer
327
views
How to use Python while debugging in IDA
I'm debugging an .exe file in IDA.
At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
- 49
3
votes
2
answers
397
views
Why doesn't this retn instruction return from the function?
I disassembled an exe file on Windows with IDA and saw this function prologue:
I see that when the retn executes instead of returning it jumps to sub_1314cba4.
Why doesn't the retn instruction ...
- 49
2
votes
1
answer
559
views
How to see ReadFile results with ProcMon
I running procmon to monitor my process, and see that my process uses ReadFile API.
How can I see which data the process received when it uses ReadFile?
- 35
7
votes
1
answer
335
views
How to detect internal and shared libraries used in an executable file?
Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
- 223
3
votes
1
answer
3k
views
How to unpack Inno Setup bundles with Arc+SREP data?
I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods:
the installer didn't work for an ...
user15807
0
votes
2
answers
2k
views
Find out all valid parameters which you can pass to a executable? [closed]
Is there a way to find out all parameters which you can pass to a executable file, e.g. a .exe file?
Example: The game GTA V offers the parameter -verify which you can pass to the shortcut of the ....
- 101
7
votes
5
answers
2k
views
How to find out if PE executable was compiled with gcc or VisualStudio?
I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:
Using strings: How to retrieve the GCC version used to compile a given ELF executable?
Using the ...
- 1,508
3
votes
1
answer
2k
views
How to change the strings in rdata section of a executable file?
I'm a programmer and have an application (an executable file that maybe compiled from a c++ source).
It has an rdata section (read-only data section) that include many (several thousand) strings of ...
- 131
3
votes
2
answers
544
views
Track execution of bytes in a Linux executable
Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
- 31
0
votes
1
answer
123
views
Gaps between sections
After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?
- 387
2
votes
1
answer
2k
views
IDA PRO: Monitor variable during execution
I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions.
My question is how to monitor this variable? In monitor I mean is there any way to set ...
- 21
4
votes
1
answer
2k
views
How can I modify binary image resource data?
I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case.
I have noticed that some PEs contain an RCData section ...
- 193