Questions tagged [executable]

A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains.

Filter by
Sorted by
Tagged with
0
votes
1answer
1k views

How can I insert bytes with OllyDbg?

I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
1
vote
2answers
165 views

Real-time changes of executable on IDE/Assembler

I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with ...
5
votes
3answers
2k views

Is it possible for a .exe PE file to do something without any imports at all?

All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must ...
2
votes
1answer
4k views

Is it possible to extract / read a variable out of a running .exe file?

I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
1
vote
1answer
2k views

Ollydbg: Function name list like in IDA

I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
1
vote
1answer
147 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
5
votes
4answers
6k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
3
votes
2answers
5k views

Disassembling an MS-DOS EXE

I've been disassembling an MS-DOS EXE and I've been using this link http://www.delorie.com/djgpp/doc/exe/ to make heads and tails of the binary. The header seems to be an older version compared to ...
1
vote
1answer
2k views

How to bind two EXE files?

I'm working on a project that needs to be a stand-alone executable but run another executable whenever it is started. Unfortunately I don't have access to the source code of the second program to ...
0
votes
1answer
102 views

Order of architecture headers in fat (universal) executables

I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the fat_header, fat_arch and macho_header, but am having trouble finding ...
-1
votes
1answer
2k views

Trying To Read Code From Call of Duty [closed]

Before I begin I want to say for whatever reason the site wouldn't let me post this unless I didn't have the coding so I just linked it instead of it being here. This is most likely the most stupid ...
2
votes
2answers
4k views

Why does program fail to run under several debuggers?

To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
2
votes
2answers
219 views

LE executable Fixup Record Table format

So I have started reverse engineering an old LE executable. So to get a better understanding of the format. I started by writing a parser for this format. Using the following resources I have made ...
1
vote
1answer
3k views

How is .rdata used within the executable

While reverse engineering an executable, I came across specific strings of interest which where in the .rdata section: How are these constant strings used by the underlying assembly code? Are ...
1
vote
1answer
176 views

Legal issue - Game Bot calling functions of copyrighted game [closed]

I spent some time reversing game client of one popular game. Found out multiple functions, ways to make character move, attack, reversed structures containing world data, and so created logic which ...
-3
votes
1answer
411 views

Cannot find the error message

I am trying to reverse engineer a program called HD sentinel. What it does, is that shows the health of your disk. Anyway, i try to register, this way i take the error message. Then, i open ollydbg. I ...
-1
votes
1answer
717 views

Reverse engineering of executable code

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the ...
6
votes
2answers
843 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
0
votes
2answers
3k views

How to analyze deeply every single step of a windows executable/installer [closed]

Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries. Is there a particular tool that tells me ...
3
votes
3answers
2k views

How to edit an .exe file without overwriting previous information

A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this ...
2
votes
2answers
28k views

Is it possible to extract or otherwise edit the source code of an .exe file?

I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a ...
6
votes
1answer
526 views

Difference between Win7 and Win8 PE loader?

Is it known what the differences between the Window 7 and Windows 8 PE loader are? I'm trying to hand-craft a simple executable PE image file. It runs well in Windows 7, but is rejected by Windows 8....
4
votes
3answers
3k views

How does disassembler really work?

a simple portable executable file looks like : I'm wondering how a disassembler works to parse the .text...to produce assembly code ? Because the PE file in his raw format seems to be unusable and ...
1
vote
1answer
6k views

adding data and code to existing .exe file on Windows [closed]

I am trying to add new functionality to a hard-coded exe of a game like adding new creatures and new spells and adding spells to creatures that did not have them before. For that I need to ...
0
votes
2answers
458 views

GUI apps uses registry,how?

I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a ...
0
votes
1answer
191 views

How to find out what encryption/encoding has been used

So my uni just had some on break into the email server and send out a load of emails with a suspicious looking executable. I'm on Linux so I downloaded the file and ran the Strings command and saw a ...
0
votes
1answer
3k views

When anaylsing a PE (.exe) in IDA Pro how can I jump to the 'user code' section and skip all the header/libary code?

Suppose I'm dissembling helloworld.exe (a program that outputs the string "hello world") and want to see the user code or code section for the file in IDA Pro. In what address would the user code be ...
-5
votes
1answer
3k views

Is it possible to decompile the password protected rar file? [closed]

I'm trying to crack winrar's password using some methods as explained below. Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years. But, if we ...
1
vote
1answer
4k views

Can mprotect set the stack itself as executable?

I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM($ uname -r -> 3.13.0-32-generic) The tutorial makes a call to mprotect to set a certain region ...
5
votes
5answers
1k views

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

I bought a decibel meter off amazon recently (http://www.amazon.com/Sound-Measure-Tester-Pressure-Decibel/dp/B00CPKSE38/ref=sr_1_1?ie=UTF8&qid=1436376590&sr=8-1&keywords=wensn) which ...
0
votes
2answers
2k views

Getting License Key from Installed Program and Making Installed Program an Executable Installer

I want to start off by apologizing because I am not a software engineer so it is quite possible that what I ask cannot be done, I looked up the wrong thing, or I just don't understand what I am ...
-1
votes
2answers
3k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
1
vote
2answers
414 views

How to find compressed or encrypted parts in a packed executable?

I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or ...
1
vote
2answers
837 views

identify packer compression or encryption algorithm

I do have an executable packed file. I want to detect compression or encryption algorithm dynamic and static ways separatly; of course without signature base way. How can I detect compression or ...
2
votes
3answers
14k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
4
votes
1answer
3k views

Extracting a private key from memory

I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. ...
4
votes
3answers
1k views

Are there exports with neither ordinal nor name or am I not understanding the PE documentation?

I don't understand one thing in the export data directory of PE files. The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
4
votes
1answer
656 views

What is an indicator that a PE section definitely contains stuff of a specific type?

I was recently working with the Microsoft documentation about the PE and COFF specifications. Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
3
votes
2answers
701 views

Ways to define portable executable bitness 64 vs 32

I found several ways to define the bitness of PE. IMAGE_FILE_HEADER contains the/a (how do you choose an article type in such place?) field Characteristics that could be checked for ...
2
votes
2answers
957 views

Can one modify a program by "wrapping" its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
0
votes
1answer
4k views

Can't change the icon of a .exe file. Seems to be protected?

I'm trying to change the icon of a .exe file, normally a simple task but this .exe file is a installer and for some reason when after I change or remove the icon, the exe shrinks in size from 300 mb ...
0
votes
2answers
838 views

large exe in ollydbg

I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process. I am on windows 7, ...
5
votes
1answer
2k views

Is not valid win32 application. Why?

Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative. I would like to ask if ...
8
votes
2answers
10k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
2
votes
1answer
2k views

Does PeID signatures work with 64-Bit Portable Executable (EXE) files?

Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support. My main ...
0
votes
1answer
2k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
20
votes
4answers
7k views

Check if exe is 64-bit

How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
2
votes
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
1
vote
1answer
249 views

How does the OS distinguish between executable types

Executable files created through managed framework like .Net have .exe extension whereas application created through languages like C++ also has .exe extension. How does the OS knows whether to run ...
0
votes
1answer
591 views

Extract a global variable [duplicate]

I'm trying to extact a global variable from an executable. Basically, I'm tryin to reverse an executable that put some python bytecode in a global variable and I'd like to extract it. I found out that ...