Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [patch-reversing]

Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software.

1
vote
1answer
28 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
0
votes
2answers
43 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
0
votes
1answer
42 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
0
votes
1answer
28 views

immediate value change when start debugging

I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8. I added code like this. (Assembly) (Hex dump) mov eax, 638BACh --> B8 AC 8B 63 00 Not problem ...
1
vote
1answer
46 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
1
vote
2answers
216 views

Patching a class file inside Jar using bytecode

I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
1
vote
0answers
124 views

Java Bytecode edit

Hi, I would like to edit one compiled java class file & like to insert & edit a couple of lines. I'm trying to make a patch for a software & when I compare this two file the only change I ...
0
votes
0answers
77 views

reverse engeneer, patching and reverse tool course

I saw those posts Looking for reverse engneer online course and Where to find (free) training in reverse engineering? but that not what I looking for. I looking for RE course that has those subjects:...
-2
votes
2answers
116 views

Looking for reverse engneer online course [duplicate]

I looking for online reverse engeneer course. Course that study ida,reverse and patch for windows/ linux. Working with ida and another tool. I like many videos lesons. Do you know one?
0
votes
1answer
127 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
-2
votes
1answer
61 views

Change binary without damage [closed]

How can I change (add/edit/remove) assembly instruction from binary file without damage? I know that at binary function save on specific offset/address, so if I change something I will damage all ...
0
votes
0answers
63 views

edit java bytecode got error

I have a java application with a lot of .class files. I edited one function at a class file and added a few lines but got an error. I added those lines: aload 1 (load argument 1 to stack) ldc_w "...
8
votes
0answers
973 views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
1
vote
1answer
233 views

Find changes between two UEFI firmware versions?

I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the ...
5
votes
2answers
224 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
3
votes
1answer
2k views

Changing strings in Hopper Disassembler

I am currently learning and I wanted to ask, how can I change a text (string) from inside an app I am reversing? For example "To begin, please login". I have found the XREF to the string location but ...
0
votes
1answer
330 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
0
votes
0answers
83 views

reverse cydia tool in jailbroken iphone

I am trying to reverse a cydia tool which is running on iphone background (with support from daemon). I have tried to use cycript but can not access the method although I can dump method from ...
3
votes
1answer
1k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
1
vote
2answers
360 views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
4
votes
1answer
740 views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
1
vote
1answer
431 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
0
votes
0answers
77 views

Understand the hex values of CA-Clipper *.OVL files

Does anybody know any helpful information to understand the *.OVL files in CA-Clipper DOS program? OVL files contains fragmented parts of the binary, so if it's possible to understand the hex values ...
0
votes
0answers
90 views

Reversing so lib's with IDA

When i decompile APK file there are .so lib's i choise the one with my CPU architecture in my case ARMv7. The .so lib's are writen in C#, but i can't see the fine C sharp code, even when i decompile ...
4
votes
0answers
124 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
1
vote
1answer
281 views

how to fix this rsrc data in ida pro?

how to find a reference for a string data reference in Ida Pro? I'm not pro just trying to learn. thanks
-1
votes
0answers
387 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
0
votes
1answer
91 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
3
votes
1answer
4k views

How do I change a string correctly in IDA Pro?

I am trying to patch a cydia tweak which has been developed by using Objective-C. I would like to modify a piece of code to suite my need. I'm using IDA Pro V6.8 for my examining. After inspecting, I ...
0
votes
1answer
1k views

How can I patch this file?

In viewing the diff for two files, a method in the original file starts with: push ebp mov ebp, esp and in the modified file, it starts with: push 0 pop rax retn endp In essence, the ...
0
votes
0answers
69 views

tools like patchdiff and bindiff for x64 [duplicate]

I know the patchdiff it also for X64 but it crash on my ida. so is there any tools like this for x64? thanks for all helpers this is not this question i am talking about x64 bins
0
votes
1answer
619 views

how can file size and PE size cant be equal?

I have an app i embedded another executable inside as a resource to see if the sizes will be different but they aint and using the resource editor i can see the app inside. as for my target the file ...
1
vote
1answer
67 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
4
votes
3answers
618 views

is ther a way an app can display a message without the use of messagebox API?

I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
1
vote
0answers
48 views

What is array of applicable components?

I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx. I would ...
3
votes
3answers
2k views

How to view strings in an executable?

I have been playing around, searching for Strings "Please wait!!!" "Done!!" Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this File pos Mem ...
-1
votes
1answer
76 views

How to modify Data Section of an exe(DD x000455)?

005A45A6 > \83FE 50 CMP ESI,50 ; Switch (cases 0..50) 005A45A9 0F87 79150000 JA AcroByte.005A5B28 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA 005A45B6 . ...
0
votes
1answer
116 views

How to change text on the button?

I am new to reversing and I need to get some reversing experience. I need help on how to change the text on the Button. for example my Delphi xe app have the button(Continue) and I want to change it ...
0
votes
0answers
109 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
5
votes
1answer
7k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
0
votes
0answers
496 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
0
votes
2answers
791 views

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ? Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
1
vote
1answer
102 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...
2
votes
1answer
331 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
2
votes
1answer
2k views

Decompile erlang .beam files compiled without debug_info

I have an app that use erlang .beam compiled files without debugging information. Someone have some tips how to decompile or reverse engineering these? Thanks in advance
1
vote
2answers
5k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
2
votes
3answers
10k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
0
votes
2answers
3k views

Hints to reverse engineering a QT software

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA. This software use a protection schema to indetify the number of click made on a QList. After a random amount ...
-2
votes
4answers
729 views

How to add new button to an executable?

My target exe file has a button. It will display a webpage when the button is clicked on. I used OllyDBG to disassemble this file. My questions are: How can I find the url of this webpage? I have ...
1
vote
2answers
1k views

Modify py2exe packed executable

I have an application in Python compiled with py2exe. I have successfully extracted python scripts using Py2ExeDumper converted to .py using Easy Python Decompiler. I made some modification to the ...