Questions tagged [executable]

A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains.

Filter by
Sorted by
Tagged with
-1
votes
1answer
553 views

Reverse engineering of executable code

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the ...
6
votes
2answers
719 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
0
votes
2answers
2k views

How to analyze deeply every single step of a windows executable/installer [closed]

Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries. Is there a particular tool that tells me ...
3
votes
3answers
2k views

How to edit an .exe file without overwriting previous information

A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this ...
1
vote
2answers
22k views

Is it possible to extract or otherwise edit the source code of an .exe file?

I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a ...
6
votes
1answer
457 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
4
votes
3answers
2k views

How does disassembler really work?

a simple portable executable file looks like : I'm wondering how a disassembler works to parse the .text...to produce assembly code ? Because the PE file in his raw format seems to be unusable and ...
1
vote
1answer
5k views

adding data and code to existing .exe file on Windows [closed]

I am trying to add new functionality to a hard-coded exe of a game like adding new creatures and new spells and adding spells to creatures that did not have them before. For that I need to ...
0
votes
2answers
336 views

GUI apps uses registry,how?

I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a ...
0
votes
1answer
167 views

How to find out what encryption/encoding has been used

So my uni just had some on break into the email server and send out a load of emails with a suspicious looking executable. I'm on Linux so I downloaded the file and ran the Strings command and saw a ...
0
votes
1answer
2k views

When anaylsing a PE (.exe) in IDA Pro how can I jump to the 'user code' section and skip all the header/libary code?

Suppose I'm dissembling helloworld.exe (a program that outputs the string "hello world") and want to see the user code or code section for the file in IDA Pro. In what address would the user code be ...
-4
votes
1answer
2k views

Is it possible to decompile the password protected rar file? [closed]

I'm trying to crack winrar's password using some methods as explained below. Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years. But, if we ...
1
vote
1answer
3k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
5
votes
5answers
1k views

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

I bought a decibel meter off amazon recently (http://www.amazon.com/Sound-Measure-Tester-Pressure-Decibel/dp/B00CPKSE38/ref=sr_1_1?ie=UTF8&qid=1436376590&sr=8-1&keywords=wensn) which ...
0
votes
2answers
2k views

Getting License Key from Installed Program and Making Installed Program an Executable Installer

I want to start off by apologizing because I am not a software engineer so it is quite possible that what I ask cannot be done, I looked up the wrong thing, or I just don't understand what I am ...
-1
votes
2answers
2k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
1
vote
2answers
319 views

How to find compressed or encrypted parts in a packed executable?

I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or ...
1
vote
2answers
659 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
2
votes
3answers
13k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2
votes
1answer
2k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
4
votes
2answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and ...
4
votes
1answer
591 views

What is an indicator that a PE section definitely contains stuff of a specific type?

I was recently working with the Microsoft documentation about the PE and COFF specifications. Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
3
votes
2answers
569 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
1
vote
3answers
780 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
0
votes
1answer
4k views

Can't change the icon of a .exe file. Seems to be protected?

I'm trying to change the icon of a .exe file, normally a simple task but this .exe file is a installer and for some reason when after I change or remove the icon, the exe shrinks in size from 300 mb ...
0
votes
2answers
751 views

large exe in ollydbg

I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process. I am on windows 7, ...
5
votes
1answer
1k views

Is not valid win32 application. Why?

Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative. I would like to ask if ...
8
votes
2answers
9k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
1
vote
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
0
votes
1answer
2k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
19
votes
4answers
5k views

Check if exe is 64-bit

How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
1
vote
1answer
243 views

How does the OS distinguish between executable types

Executable files created through managed framework like .Net have .exe extension whereas application created through languages like C++ also has .exe extension. How does the OS knows whether to run ...
0
votes
1answer
554 views

Extract a global variable [duplicate]

I'm trying to extact a global variable from an executable. Basically, I'm tryin to reverse an executable that put some python bytecode in a global variable and I'd like to extract it. I found out that ...
0
votes
1answer
202 views

Extracting a variable from an executable

I'd like to extract the M__hello_ variable of this code from the executable (for learning purpose). I'd like to have this array back in a variable in any programming language Do you know how can I do ...
6
votes
3answers
3k views

How to strip more than symbols?

I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file. For instance: #include <iostream> using ...
3
votes
1answer
2k views

OllyDBG causes executables saved by it to ask for administrator privileges when run

Whenever I save an executable in OllyDBG (Right-click, Copy to executable, All modifications then Save File), the saved executable asks for administrator privileges when I run it. I tried opening ...
9
votes
3answers
18k views

Get jar back from wrapped(into exe) jar

Is there any way to get a jar file from a jar wrapped using a exe wrapper. I have an exe file and I know that it was wrapper using exe wrapper (launch4j to be precise). How do I unwrap this jar to get ...
47
votes
7answers
107k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
8
votes
1answer
479 views

Loading Windows executable - unexpected data appended at beginning sections after loading in memory

Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
5
votes
1answer
416 views

Differences in memory dumps of executable data

I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection. Mainly I try to ...
4
votes
3answers
4k views

Special Properties of Delphi (Object Pascal) Executables

While reading some threads on other reverse engineering forums, I learned that executable programs compiled in Delphi have special properties. I'm not sure what those special properties are but I ...
3
votes
2answers
47k views

How can I decompile my (dot)NET .EXE file into its source code [duplicate]

I was working on a C#.NET application on windows platform, I was just testing the code and I don't know somehow I messed it up and after making too much efforts on undoing, I am still not able to ...
2
votes
2answers
239 views

Secure resources from being extracted?

I have a jar file with a resources folder, and I have converted it to EXE using Launch4J. How can I protect my resources from being extracted using winzip/winrar ?
9
votes
5answers
16k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
1
vote
0answers
52 views

What are possible ways to dynamically analyze windows service? [duplicate]

I am working executable, which is meant to be loaded as windows service. I have statically determine certain breakpoints that I'd like it to break upon execution. Is there any particular way to ...
3
votes
2answers
13k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
16
votes
4answers
7k views

USB Dongle Traffic Monitoring

How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic? Since I am new to this type of thing, any ...
6
votes
1answer
303 views

Available tools & techniques for locating sections of interest in a binary executable

If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate ...
10
votes
2answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.