Questions tagged [patch-reversing]

Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software.

Filter by
Sorted by
Tagged with
3
votes
1answer
106 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
0
votes
0answers
23 views

send screenshot to server if client is found under debug

if the client under debug detect there are some debugger attached, like throwing out single step exception, will it take a screenshot of my desktop then send to its server to prove that I am trying to ...
1
vote
1answer
56 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
18 views

editing an executable VB file which extracts another vb file from itself

well, I don't know if the title suffices or not. so I'm going in details: there's a VB target I'm working on and it is packed. I unpacked it ok but the main exe extracts another exe from within itself ...
0
votes
0answers
60 views

Pe file Vmp0 vmp1 section,

I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
0
votes
1answer
62 views

Easy way to understand vulnerable functions while Reversing [closed]

I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code. As I am new to this stuff, I am getting some issues of ...
0
votes
0answers
80 views

What kind of compression/encryption could this be?

I am dealing with a file that seems to use some kind of proprietary compression/encryption I can't figure out. I have a lot of sample files as well as different versions of the same file, so I have ...
1
vote
1answer
271 views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
1
vote
2answers
159 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
2
votes
2answers
187 views

In reverse engineering, what does it mean to “patch a file”?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
0
votes
0answers
45 views

How to execute an import exe/dll from memory

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?
1
vote
1answer
306 views

Change instruction test eax, eax to text eax, 1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...
0
votes
2answers
527 views

Find flag from GO binary challenge [closed]

I have GO binary file from challenge (that already over). I spent around 3 days to find the flag without results. I'm trying to load the file with gdb and using the following command: First, Trying ...
0
votes
0answers
33 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
103 views

Not able to find Hard coded strings in the mac executable file

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
1
vote
0answers
154 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
1answer
114 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
2
votes
0answers
72 views

Patching an app that updates frequently

Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours The updates are really needed for the app to work So i was wondering what can i ...
2
votes
1answer
205 views

Has there been any success in using deep learning for reverse engineering?

So has there been any success in using deep learning for doing reverse engineering? i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent ...
2
votes
1answer
241 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
1
vote
2answers
107 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
0
votes
2answers
290 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
0
votes
1answer
79 views

immediate value change when start debugging

I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8. I added code like this. (Assembly) (Hex dump) mov eax, 638BACh --> B8 AC 8B 63 00 Not problem ...
1
vote
1answer
199 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
1
vote
2answers
2k views

Patching a class file inside Jar using bytecode

I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
1
vote
0answers
349 views

Java Bytecode edit

Hi, I would like to edit one compiled java class file & like to insert & edit a couple of lines. I'm trying to make a patch for a software & when I compare this two file the only change I ...
-2
votes
2answers
144 views

Looking for reverse engneer online course [duplicate]

I looking for online reverse engeneer course. Course that study ida,reverse and patch for windows/ linux. Working with ida and another tool. I like many videos lesons. Do you know one?
1
vote
1answer
556 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
0
votes
1answer
136 views

Change binary without damage [closed]

How can I change (add/edit/remove) assembly instruction from binary file without damage? I know that at binary function save on specific offset/address, so if I change something I will damage all ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
1
vote
1answer
745 views

Find changes between two UEFI firmware versions?

I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the ...
4
votes
2answers
495 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
4
votes
1answer
4k views

Changing strings in Hopper Disassembler

I am currently learning and I wanted to ask, how can I change a text (string) from inside an app I am reversing? For example "To begin, please login". I have found the XREF to the string location but ...
1
vote
1answer
501 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
5
votes
1answer
4k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
1
vote
2answers
1k views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
4
votes
1answer
2k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
1
vote
1answer
683 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
3
votes
0answers
172 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
1
vote
1answer
582 views

how to fix this rsrc data in ida pro?

how to find a reference for a string data reference in Ida Pro? I'm not pro just trying to learn. thanks
-1
votes
0answers
528 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
0
votes
1answer
300 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
3
votes
1answer
6k views

How do I change a string correctly in IDA Pro?

I am trying to patch a cydia tweak which has been developed by using Objective-C. I would like to modify a piece of code to suite my need. I'm using IDA Pro V6.8 for my examining. After inspecting, I ...
0
votes
1answer
4k views

How can I patch this file?

In viewing the diff for two files, a method in the original file starts with: push ebp mov ebp, esp and in the modified file, it starts with: push 0 pop rax retn endp In essence, the ...
0
votes
1answer
2k views

how can file size and PE size cant be equal?

I have an app i embedded another executable inside as a resource to see if the sizes will be different but they aint and using the resource editor i can see the app inside. as for my target the file ...
1
vote
1answer
100 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
3
votes
3answers
985 views

is ther a way an app can display a message without the use of messagebox API?

I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
1
vote
0answers
52 views

What is array of applicable components?

I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx. I would ...
4
votes
3answers
10k views

How to view strings in an executable?

I have been playing around, searching for Strings "Please wait!!!" "Done!!" Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this File pos Mem ...
-1
votes
1answer
101 views

How to modify Data Section of an exe(DD x000455)?

005A45A6 > \83FE 50 CMP ESI,50 ; Switch (cases 0..50) 005A45A9 0F87 79150000 JA AcroByte.005A5B28 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA 005A45B6 . ...