Questions tagged [patch-reversing]

Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software.

Filter by
Sorted by
Tagged with
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
7
votes
1answer
1k views

Reversing Patches (Binary Diffing)

Does any of you know of a recent tool to bindiff using ImmunityDebugger? I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare'...
6
votes
1answer
5k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
5
votes
1answer
3k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
5
votes
1answer
4k views

Changing strings in Hopper Disassembler

I am currently learning and I wanted to ask, how can I change a text (string) from inside an app I am reversing? For example "To begin, please login". I have found the XREF to the string location but ...
5
votes
1answer
10k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
4
votes
3answers
12k views

How to view strings in an executable?

I have been playing around, searching for Strings "Please wait!!!" "Done!!" Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this File pos Mem ...
4
votes
2answers
667 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
3
votes
3answers
1k views

is ther a way an app can display a message without the use of messagebox API?

I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
3
votes
1answer
163 views

How can I retrieve the encryption key in this code?

can anyone explain the following code? is it possible to retrieve the encryption key? I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like ...
3
votes
1answer
7k views

How do I change a string correctly in IDA Pro?

I am trying to patch a cydia tweak which has been developed by using Objective-C. I would like to modify a piece of code to suite my need. I'm using IDA Pro V6.8 for my examining. After inspecting, I ...
3
votes
2answers
304 views

In reverse engineering, what does it mean to “patch a file”?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
3
votes
1answer
694 views

PatchDiff2 Outputting results to a Text File

I have attempted working with BinDiff to compare files and save the output, but unfortunately I am unable to save it to anything other than a .BinDiff or .BinExport file type. To try and counter this ...
3
votes
0answers
81 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
3
votes
0answers
181 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
2
votes
3answers
13k views

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

I am following this tutorial on reverse engineering. In the step where I "search for all referenced strings" I get a window as follows: When compared to the image on the tutorial for the step, I ...
2
votes
2answers
2k views

Patching a class file inside Jar using bytecode

I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
2
votes
1answer
4k views

Decompile erlang .beam files compiled without debug_info

I have an app that use erlang .beam compiled files without debugging information. Someone have some tips how to decompile or reverse engineering these? Thanks in advance
2
votes
1answer
226 views

Has there been any success in using deep learning for reverse engineering?

So has there been any success in using deep learning for doing reverse engineering? i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent ...
2
votes
1answer
580 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
2
votes
0answers
93 views

Patching an app that updates frequently

Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours The updates are really needed for the app to work So i was wondering what can i ...
2
votes
1answer
285 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
1
vote
1answer
451 views

Change instruction test eax, eax to text eax, 1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...
1
vote
1answer
155 views

Not able to find Hard coded strings in the mac executable file

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
1
vote
2answers
103 views

Decrypt application protocol packet

I have several applications that interact with the network, but the data is encrypted. I set breakpoints on send ws2_32.dll and found the correct buffer in which the encrypted data was located (then I ...
1
vote
2answers
230 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
1
vote
2answers
121 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
1
vote
1answer
732 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
1
vote
1answer
676 views

how to fix this rsrc data in ida pro?

how to find a reference for a string data reference in Ida Pro? I'm not pro just trying to learn. thanks
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
1
vote
4answers
2k views

How to cause program to stop execution when a particular value is found in memory

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X ...
1
vote
1answer
480 views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
1
vote
2answers
1k views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
1
vote
2answers
6k views

Hints to reverse engineering a QT software

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA. This software use a protection schema to indetify the number of click made on a QList. After a random amount ...
1
vote
2answers
2k views

Modify py2exe packed executable

I have an application in Python compiled with py2exe. I have successfully extracted python scripts using Py2ExeDumper converted to .py using Easy Python Decompiler. I made some modification to the ...
1
vote
1answer
1k views

IDA Pro breakpoints with side effects

I am trying to set a breakpoint that works by applying a condition. More precisely, I am trying to change the count increment in the AL register by placing a breakpoint condition saying AL = Al - 1 ...
1
vote
1answer
761 views

Editing a Mach-O x86_64 binary with 0xED results in a app crash

I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement. Then I decided to see if I could modify the ...
1
vote
1answer
238 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
1
vote
1answer
674 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
1
vote
1answer
939 views

Find changes between two UEFI firmware versions?

I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the ...
1
vote
1answer
537 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
1
vote
1answer
108 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
1
vote
1answer
108 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...
1
vote
1answer
6k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
1
vote
1answer
2k views

automatically find and nop an instruction in IDA

These are my first steps in IDA script, so please be kind. I want to create some sort of script that, every time it finds the following instruction: MOV R1, #0x4D080 to automatically replace it ...
1
vote
0answers
49 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
55 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
0answers
167 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
1
vote
0answers
375 views

Java Bytecode edit

Hi, I would like to edit one compiled java class file & like to insert & edit a couple of lines. I'm trying to make a patch for a software & when I compare this two file the only change I ...
1
vote
0answers
52 views

What is array of applicable components?

I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx. I would ...