Questions tagged [executable]

A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains.

Filter by
Sorted by
Tagged with
1
vote
1answer
24 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
0
votes
0answers
37 views

Which API function is responsible for input strings?

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
4
votes
3answers
3k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
0
votes
1answer
143 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
14
votes
4answers
5k views

Check if exe is 64-bit

How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
0
votes
1answer
46 views

Hex editing a program to change variable types

For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand. ...
0
votes
0answers
49 views

I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?

I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system. Can I edit the code off the .exe file? I need to change a value in the code. Thank ...
2
votes
3answers
336 views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
4
votes
3answers
2k views

Is it possible for a .exe PE file to do something without any imports at all?

All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
1
vote
1answer
95 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
7
votes
1answer
176 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
0
votes
2answers
17k views

Is it possible to extract or otherwise edit the source code of an .exe file?

I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a ...
16
votes
4answers
7k views

USB Dongle Traffic Monitoring

How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic? Since I am new to this type of thing, any ...
2
votes
1answer
659 views

How can I modify binary image resource data?

I've been hacking and modding software for years and have learned alot, but there are still a few things that vex me, this is one such case. I have noticed that some PEs contain an RCData section that ...
9
votes
3answers
680 views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
3
votes
1answer
48 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
2
votes
3answers
12k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
-3
votes
1answer
181 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
-1
votes
1answer
62 views

How to use Python while debugging in IDA

I'm debugging an .exe file in IDA. At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
3
votes
2answers
164 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
2
votes
1answer
122 views

How to see ReadFile results with ProcMon

I running procmon to monitor my process, and see that my process uses ReadFile API. How can I see which data the process received when it uses ReadFile?
3
votes
1answer
617 views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
0
votes
2answers
82 views

Find out all valid parameters which you can pass to a executable? [closed]

Is there a way to find out all parameters which you can pass to a executable file, e.g. a .exe file? Example: The game GTA V offers the parameter -verify which you can pass to the shortcut of the ....
3
votes
4answers
379 views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
2
votes
2answers
222 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
44
votes
7answers
91k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
9
votes
2answers
16k views

Get jar back from wrapped(into exe) jar

Is there any way to get a jar file from a jar wrapped using a exe wrapper. I have an exe file and I know that it was wrapper using exe wrapper (launch4j to be precise). How do I unwrap this jar to get ...
3
votes
3answers
2k views

How does disassembler really work?

a simple portable executable file looks like : I'm wondering how a disassembler works to parse the .text...to produce assembly code ? Because the PE file in his raw format seems to be unusable and ...
0
votes
1answer
635 views

How can I insert bytes with OllyDbg?

I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
2
votes
1answer
888 views

How to change the strings in rdata section of a executable file?

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). It has an rdata section (read-only data section) that include many (several thousand) strings of ...
0
votes
1answer
82 views

Gaps between sections

After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?
2
votes
1answer
514 views

IDA PRO: Monitor variable during execution

I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions. My question is how to monitor this variable? In monitor I mean is there any way to set ...
5
votes
1answer
2k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
1
vote
1answer
90 views

Change sending IP of only certain executable

An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
1
vote
2answers
137 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
2
votes
1answer
2k views

Is it possible to extract / read a variable out of a running .exe file?

I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
1
vote
1answer
122 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
0
votes
1answer
828 views

Ollydbg: Function name list like in IDA

I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
1
vote
1answer
1k views

How to bind two EXE files?

I'm working on a project that needs to be a stand-alone executable but run another executable whenever it is started. Unfortunately I don't have access to the source code of the second program to ...
1
vote
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
2
votes
2answers
2k views

Disassembling an MS-DOS EXE

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to ...
1
vote
3answers
684 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
6
votes
5answers
1k views

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

I bought a decibel meter off amazon recently (http://www.amazon.com/Sound-Measure-Tester-Pressure-Decibel/dp/B00CPKSE38/ref=sr_1_1?ie=UTF8&qid=1436376590&sr=8-1&keywords=wensn) which ...
2
votes
2answers
2k views

Why does program fail to run under several debuggers?

To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
5
votes
1answer
402 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
0
votes
1answer
98 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
-1
votes
1answer
534 views

Trying To Read Code From Call of Duty [closed]

Before I begin I want to say for whatever reason the site wouldn't let me post this unless I didn't have the coding so I just linked it instead of it being here. This is most likely the most stupid ...
2
votes
2answers
130 views

LE executable Fixup Record Table format

So I have started reverse engineering an old LE executable. So to get a better understanding of the format. I started by writing a parser for this format. Using the following resources I have made ...
1
vote
1answer
1k views

How is .rdata used within the executable

While reverse engineering an executable, I came across specific strings of interest which where in the .rdata section: How are these constant strings used by the underlying assembly code? Are ...