Questions tagged [executable]

A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains.

Filter by
Sorted by
Tagged with
52 votes
7 answers
141k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
user avatar
45 votes
8 answers
32k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
user avatar
  • 2,285
20 votes
4 answers
7k views

Check if exe is 64-bit

How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
user avatar
  • 789
16 votes
4 answers
8k views

USB Dongle Traffic Monitoring

How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic? Since I am new to this type of thing, any ...
user avatar
11 votes
3 answers
3k views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
user avatar
  • 113
10 votes
5 answers
18k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
10 votes
2 answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
user avatar
  • 3,866
9 votes
3 answers
21k views

Get jar back from wrapped(into exe) jar

Is there any way to get a jar file from a jar wrapped using a exe wrapper. I have an exe file and I know that it was wrapper using exe wrapper (launch4j to be precise). How do I unwrap this jar to get ...
user avatar
  • 243
8 votes
1 answer
4k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
user avatar
8 votes
2 answers
10k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
user avatar
8 votes
1 answer
512 views

Loading Windows executable - unexpected data appended at beginning sections after loading in memory

Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
user avatar
7 votes
4 answers
4k views

Unpacking binary statically

Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
user avatar
7 votes
5 answers
2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
user avatar
  • 1,446
7 votes
3 answers
5k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
user avatar
7 votes
1 answer
303 views

How to detect internal and shared libraries used in an executable file?

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. ...
user avatar
  • 223
6 votes
2 answers
296 views

How should I go about trying to figure out the programming language that was used?

I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler. What should be done after that ? ...
user avatar
  • 2,285
6 votes
2 answers
863 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
user avatar
  • 63
6 votes
1 answer
314 views

Available tools & techniques for locating sections of interest in a binary executable

If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate ...
user avatar
  • 193
6 votes
1 answer
530 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
user avatar
5 votes
3 answers
3k views

Is it possible for a .exe PE file to do something without any imports at all?

All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
user avatar
  • 1,625
5 votes
5 answers
1k views

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

I bought a decibel meter off amazon recently (http://www.amazon.com/Sound-Measure-Tester-Pressure-Decibel/dp/B00CPKSE38/ref=sr_1_1?ie=UTF8&qid=1436376590&sr=8-1&keywords=wensn) which ...
user avatar
5 votes
3 answers
5k views

Special Properties of Delphi (Object Pascal) Executables

While reading some threads on other reverse engineering forums, I learned that executable programs compiled in Delphi have special properties. I'm not sure what those special properties are but I ...
user avatar
  • 93
5 votes
1 answer
2k views

Is not valid win32 application. Why?

Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative. I would like to ask if ...
user avatar
  • 789
5 votes
3 answers
7k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
user avatar
  • 223
5 votes
1 answer
491 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
user avatar
  • 2,826
4 votes
2 answers
18k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
user avatar
  • 263
4 votes
1 answer
9k views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
user avatar
4 votes
3 answers
3k views

How does disassembler really work?

a simple portable executable file looks like : I'm wondering how a disassembler works to parse the .text...to produce assembly code ? Because the PE file in his raw format seems to be unusable and ...
user avatar
4 votes
3 answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
user avatar
  • 993
4 votes
1 answer
690 views

What is an indicator that a PE section definitely contains stuff of a specific type?

I was recently working with the Microsoft documentation about the PE and COFF specifications. Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
user avatar
  • 993
4 votes
1 answer
579 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
user avatar
  • 273
4 votes
1 answer
3k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
user avatar
  • 51
3 votes
2 answers
347 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
user avatar
3 votes
3 answers
2k views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
user avatar
3 votes
1 answer
2k views

How can I modify binary image resource data?

I've been hacking and modding software for years and have learned alot, but there are still a few things that vex me, this is one such case. I have noticed that some PEs contain an RCData section that ...
user avatar
3 votes
3 answers
2k views

How to edit an .exe file without overwriting previous information

A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this ...
user avatar
3 votes
2 answers
6k views

Disassembling an MS-DOS EXE

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to ...
user avatar
  • 133
3 votes
2 answers
51k views

How can I decompile my (dot)NET .EXE file into its source code [duplicate]

I was working on a C#.NET application on windows platform, I was just testing the code and I don't know somehow I messed it up and after making too much efforts on undoing, I am still not able to ...
user avatar
  • 263
3 votes
1 answer
63 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
user avatar
  • 133
3 votes
1 answer
2k views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
user avatar
3 votes
1 answer
2k views

How to change the strings in rdata section of a executable file?

I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). It has an rdata section (read-only data section) that include many (several thousand) strings of ...
user avatar
3 votes
2 answers
723 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
user avatar
  • 131
3 votes
2 answers
504 views

Track execution of bytes in a Linux executable

Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph ...
user avatar
3 votes
1 answer
2k views

OllyDBG causes executables saved by it to ask for administrator privileges when run

Whenever I save an executable in OllyDBG (Right-click, Copy to executable, All modifications then Save File), the saved executable asks for administrator privileges when I run it. I tried opening ...
user avatar
  • 133
2 votes
3 answers
354 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
user avatar
  • 121
2 votes
2 answers
29k views

Is it possible to extract or otherwise edit the source code of an .exe file?

I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a ...
user avatar
2 votes
3 answers
14k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
user avatar
  • 123
2 votes
1 answer
836 views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
user avatar
  • 23
2 votes
2 answers
1k views

Can one modify a program by "wrapping" its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
user avatar
  • 146
2 votes
2 answers
434 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
user avatar
  • 23