Questions tagged [patch-reversing]

Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software.

Filter by
Sorted by
Tagged with
4
votes
2answers
700 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
1
vote
1answer
546 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
1
vote
1answer
108 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...
5
votes
1answer
3k views

xor eax, eax in x64

I have following code: sub rsp, 40 ; 00000028H lea rcx, OFFSET FLAT:$SG4237 call printf xor eax, eax add rsp, 40 ; 00000028H ret 0 Why there is xor eax, eax , ...
1
vote
1answer
746 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
3
votes
0answers
182 views

Comparing two UEFI applications?

I have two x86-64 UEFI applications original.efi and patched.efi. I want to find out what have been changed in patched.efi and what these changes do. I have tried to use the Radare2 framework to ...
3
votes
1answer
694 views

PatchDiff2 Outputting results to a Text File

I have attempted working with BinDiff to compare files and save the output, but unfortunately I am unable to save it to anything other than a .BinDiff or .BinExport file type. To try and counter this ...
1
vote
1answer
691 views

how to fix this rsrc data in ida pro?

how to find a reference for a string data reference in Ida Pro? I'm not pro just trying to learn. thanks
7
votes
1answer
1k views

Reversing Patches (Binary Diffing)

Does any of you know of a recent tool to bindiff using ImmunityDebugger? I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare'...
-1
votes
0answers
572 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
0
votes
1answer
331 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
3
votes
1answer
7k views

How do I change a string correctly in IDA Pro?

I am trying to patch a cydia tweak which has been developed by using Objective-C. I would like to modify a piece of code to suite my need. I'm using IDA Pro V6.8 for my examining. After inspecting, I ...
3
votes
3answers
1k views

is ther a way an app can display a message without the use of messagebox API?

I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
0
votes
1answer
5k views

How can I patch this file?

In viewing the diff for two files, a method in the original file starts with: push ebp mov ebp, esp and in the modified file, it starts with: push 0 pop rax retn endp In essence, the ...
0
votes
1answer
2k views

how can file size and PE size cant be equal?

I have an app i embedded another executable inside as a resource to see if the sizes will be different but they aint and using the resource editor i can see the app inside. as for my target the file ...
1
vote
1answer
110 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
1
vote
0answers
52 views

What is array of applicable components?

I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx. I would ...
4
votes
3answers
13k views

How to view strings in an executable?

I have been playing around, searching for Strings "Please wait!!!" "Done!!" Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this File pos Mem ...
-1
votes
1answer
104 views

How to modify Data Section of an exe(DD x000455)?

005A45A6 > \83FE 50 CMP ESI,50 ; Switch (cases 0..50) 005A45A9 0F87 79150000 JA AcroByte.005A5B28 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA 005A45B6 . ...
-2
votes
4answers
1k views

How to add new button to an executable?

My target exe file has a button. It will display a webpage when the button is clicked on. I used OllyDBG to disassemble this file. My questions are: How can I find the url of this webpage? I have ...
0
votes
1answer
151 views

How to change text on the button?

I am new to reversing and I need to get some reversing experience. I need help on how to change the text on the Button. for example my Delphi xe app have the button(Continue) and I want to change it ...
0
votes
0answers
174 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
5
votes
1answer
11k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
0
votes
0answers
824 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
1
vote
4answers
2k views

How to cause program to stop execution when a particular value is found in memory

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X ...
1
vote
2answers
2k views

debug a .dll compressed with pe compact

I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has ...
0
votes
2answers
1k views

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ? Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
1
vote
1answer
6k views

Unpacking Asprotect SKE 2.1

Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go. In case of manual mode, I would love ...
2
votes
1answer
582 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
1
vote
2answers
6k views

Hints to reverse engineering a QT software

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA. This software use a protection schema to indetify the number of click made on a QList. After a random amount ...
1
vote
2answers
2k views

Modify py2exe packed executable

I have an application in Python compiled with py2exe. I have successfully extracted python scripts using Py2ExeDumper converted to .py using Easy Python Decompiler. I made some modification to the ...
-2
votes
1answer
146 views

How can I do this in less than 10 bytes of space?

I have some value stored at a memory location. I have 10 bytes of space and have following to do: push registers copy a string constant "abcedfghijkl" to that memory location restore registers Is it ...
1
vote
1answer
96 views

HOW do I point the debugger towards UNPACKED version of dll stored on my filesystem during debugging [closed]

Here is my problem: Program P1 launches another program P2. The P2 program uses a dll DLL1 which is packed using PE Compact. The DLL1 is obviously unpacked during run time and a routine inside DLL1 ...
0
votes
1answer
316 views

Where can i find Visual Basic Image Internal Structure Format by Alex Ionescu?

Where i can find a working link to this tutorial? I have searched a lot on the net but all links are broken. Could anyone upload it somewhere? Original link http://www.alex-ionescu.com/vb.pdf
1
vote
1answer
1k views

IDA Pro breakpoints with side effects

I am trying to set a breakpoint that works by applying a condition. More precisely, I am trying to change the count increment in the AL register by placing a breakpoint condition saying AL = Al - 1 ...
1
vote
1answer
764 views

Editing a Mach-O x86_64 binary with 0xED results in a app crash

I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement. Then I decided to see if I could modify the ...
1
vote
1answer
2k views

automatically find and nop an instruction in IDA

These are my first steps in IDA script, so please be kind. I want to create some sort of script that, every time it finds the following instruction: MOV R1, #0x4D080 to automatically replace it ...

1
2