Questions tagged [patching]

Patching is the process of adding or deleting code from an executable file in order to modify its functioning.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Patch binary while documenting original at the same time in Ghidra

I'm starting work on a simultaneous documentation and patching project on a single binary. Some of the code to be documented will also be overwritten by the patch, but most of it won't, so I need a ...
inakilbss's user avatar
  • 101
1 vote
1 answer
96 views

Patching an old piece of software [closed]

First off, let me just start by preemptively apologizing if this isn't the right place to ask this question. If that is indeed the case, let me know and I will delete the post. It's just that I'm ...
Duro Prem's user avatar
0 votes
0 answers
50 views

Is Stud_PE a legitimate program?

I have a binary that crashes at certain user input, and after using Ghidra and x64Dbg to understand what's happening, I'd like to just fix the problem. I can use Ghidra to NOP the function call that ...
AugieDawg's user avatar
1 vote
0 answers
152 views

How does Play integrity api assures Genuine app binary

I discovered that we can use the Play integrity api instead of safetynet now to assure the integrity off an app that is running. I am wondering if people have a way of bypassing the "Genuine app ...
user45316's user avatar
0 votes
1 answer
68 views

Updating legacy library in an already compiled binary

I'm dealing with a reverse engineering challenge involving a binary application that was statically compiled with a legacy library. While the legacy library is not vulnerable, it lacks certain ...
st0l4s's user avatar
  • 3
0 votes
0 answers
43 views

X64dbg question

I got a program that I try to patch. Normally you get a message box or something to get at the right point in program. But this program behaves else. It opens, then you can type in your license number ...
silvio's user avatar
  • 1
1 vote
0 answers
110 views

Inject a MessageBox to the PE file

I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
Daros911's user avatar
  • 115
1 vote
1 answer
79 views

Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)

"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
user3654535's user avatar
1 vote
0 answers
368 views

How to patch instruction with a call to a thunk function?

I started to use ghidra to begin doing some crackmes, and I need to change an instruction to a call to a thunk function. However, when I export the program back, I get a segfault. Inspecting it with ...
hl037_'s user avatar
  • 111
2 votes
0 answers
43 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
Redouane Red's user avatar
2 votes
0 answers
36 views

Finding a check in Chrome

Chrome doesn't allow switching on extensions which are not from the Chrome store. There is no this limitation in Chromium. So it is only in Chrome. It checks verified_contents.json (in which content ...
oleedd's user avatar
  • 163
1 vote
0 answers
29 views

How can I create a patch to insert a menu into an executable file which does not have a menu? [duplicate]

I need help writing a patch that inserts a menu into an application which does not have one. When I an executable file in a resource editor, I found the menu and I saved the file again and it doesn't ...
Picaboo3's user avatar
1 vote
0 answers
252 views

IDA binary patch "has no file mapping"

I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
Slluxx's user avatar
  • 11
1 vote
0 answers
84 views

Patched Mac application throws "Invalid value of (null) for entitlement" when running it

I have patched a specific application that I downloaded from the app store but when I ran the executable, it gave me a signal kill 9. I also reverted back the change I made, but the same error was ...
Raeein Bagheri's user avatar
1 vote
0 answers
36 views

How to prevent dynamic loader from modifying binary in memory?

I have patched a loadable object (an .so file) from this: xor eax,0x304b7c0 to this: mov eax,0x0 When I try to run my binary with these modifications, the application loads the .so file and then it ...
user34087's user avatar
1 vote
1 answer
105 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
Digika's user avatar
  • 53
1 vote
1 answer
71 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
captmicr0's user avatar
0 votes
1 answer
327 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
securityauditor's user avatar
1 vote
0 answers
135 views

Patching out relative calls to DLL functions

I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
John S.'s user avatar
  • 23
1 vote
2 answers
568 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
user40683's user avatar
3 votes
0 answers
41 views

How to patch bootstrap in NAND flash?

I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC I read/write that flash. How can I analyze the bootstrap and change ...
Kokomelom's user avatar
  • 281
2 votes
1 answer
200 views

ApplyPatches to input file via IDC

Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
Kirill Kirillov's user avatar
0 votes
2 answers
228 views

IDA/Olly changing address bytes after patch during debugging on x86

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing: BE E4732201 MOV ESI,App.012273E4 should ...
FELIPE_RIBAS's user avatar
5 votes
0 answers
498 views

Patching Jar File (2022)

Currently reversing a .jar program recreationally, and I understand the workflow proposed here: https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
triboulet's user avatar
0 votes
1 answer
1k views

Change global variable value in IDA

I have a global variable stored in the data section: data:00007FF7DDBF78E4 00 00 00 00 dword_7FF7DDBF78E4 dd 0 Is there a way to change its value?
Alexey's user avatar
  • 69
1 vote
1 answer
453 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
MRalwasser's user avatar
1 vote
0 answers
40 views

Need help with patching .plt function

I want to patch a .plt function but my friend told me I should use "xref" to find the real caller. I found it and patched it, Will the .plt function execute? The function start with PUSH {R4-...
Mouhamed Iyade's user avatar
0 votes
2 answers
151 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
t0astym4rsh's user avatar
0 votes
2 answers
652 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
Ahmed minegames's user avatar
1 vote
1 answer
142 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
TefoD's user avatar
  • 13
1 vote
0 answers
409 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
Steve's user avatar
  • 66
1 vote
0 answers
599 views

How to patch C# binary?

I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator. I figured out that I can directly manipulate IL instructions if I just find ...
warchantua's user avatar
0 votes
0 answers
81 views

SSL pinning deep problem

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
TrueStar's user avatar
1 vote
1 answer
5k views

Bypass USB key activation of a software

(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it) I am asked by a spa store to "do something" to make a ...
BlackXIII's user avatar
2 votes
0 answers
294 views

Automating binary patching in Hopper Disassembler using python

I am curious to know if anyone has done anything similar to what I am looking to achieve... I have a .ipa file (iOS application) that I load into to Hopper Disassembler. I search for a string to ...
user35324's user avatar
0 votes
1 answer
340 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
Synaps3's user avatar
  • 101
0 votes
0 answers
219 views

je change to jne and program issue

I am new to forum and new to programming (total noob). I am trying to modify a program using ollydbg and x32dbg and while attached to file I make the changes fine and it does what I expected. My ...
Valshardreg's user avatar
1 vote
0 answers
124 views

Statically injecting translated NASM assembly into existing ELF binary

I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection. In an effort to save time writing and debugging assembly, I took the following no-...
alcao758's user avatar
  • 111
0 votes
1 answer
135 views

ARM7 32-bit Branch Offset Calculator

I need to patch an arm7 program by replacing this fopen function by another function. .text:00018D68 52 D7 FF EB BL fopen ... .plt:0000EAB8 ; FILE *fopen(const ...
john's user avatar
  • 13
3 votes
0 answers
156 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
Revengo Engineros's user avatar
3 votes
1 answer
170 views

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
chason's user avatar
  • 33
2 votes
1 answer
249 views

OllyDBG saved executable crashes

I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
skudo's user avatar
  • 51
0 votes
1 answer
497 views

How can I mod the built-in software of my digital piano?

I'm curious if anyone has any insight on how I can manipulate or mod the code for the built-in software of a digital piano (specifically the Kawai ES8 - or really any digital piano with a display ...
blondeonia's user avatar
0 votes
1 answer
1k views

Android app crashes even while not edited, how can I solve it?

Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
hanan's user avatar
  • 309
2 votes
1 answer
422 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
1 vote
2 answers
567 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
Daan Rozebloem's user avatar
1 vote
1 answer
105 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
Zatherz's user avatar
  • 21
0 votes
0 answers
408 views

tutorial of run-time hacking with Dnspy

Is anybody have good resource or tutorial of run-time hacking or memory hacking with .NET Applications with dnspy.
KingAmir's user avatar
0 votes
1 answer
747 views

Patch Arm binary with Ida

In Ida I can patch binary that run on x86 , but not binary that run on Arm. How can I simply patch binary , change assembly(not only hex) and save to new binary file
Patc's user avatar
  • 1
1 vote
1 answer
390 views

How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?

I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this: mov r8d, 0Ah ; lpType mov ...
chentiangemalc's user avatar