Questions tagged [patching]
Patching is the process of adding or deleting code from an executable file in order to modify its functioning.
122
questions
0
votes
0
answers
6
views
How to prevent dynamic loader from modifying binary in memory?
I have patched a loadable object (an .so file) from this:
xor eax,0x304b7c0
to this:
mov eax,0x0
When I try to run my binary with these modifications, the application loads the .so file and then it ...
1
vote
1
answer
30
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 43
0
votes
0
answers
18
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
0
votes
1
answer
78
views
Hex editing an IP address of a different length
I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
- 113
1
vote
0
answers
47
views
Patching out relative calls to DLL functions
I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
- 23
0
votes
2
answers
142
views
Changing the jne to je instruction causes program to generate error
I'm trying to change the instruction from jne to je
I've change an instruction
75 0c jne [some_location]
75 0c is a 2 jump instruction.
So, I've a chaged it to from 75 0c to 74 0c which is ...
- 23
2
votes
0
answers
31
views
How to patch bootstrap in NAND flash?
I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC
I read/write that flash.
How can I analyze the bootstrap and change ...
- 71
1
vote
1
answer
44
views
ApplyPatches to input file via IDC
Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
0
votes
2
answers
89
views
IDA/Olly changing address bytes after patch during debugging on x86
I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing:
BE E4732201 MOV ESI,App.012273E4
should ...
- 103
5
votes
0
answers
173
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
0
votes
1
answer
335
views
Change global variable value in IDA
I have a global variable stored in the data section:
data:00007FF7DDBF78E4 00 00 00 00 dword_7FF7DDBF78E4 dd 0
Is there a way to change its value?
- 49
1
vote
1
answer
194
views
Binary diff + patching across versions
What are the current options for binary patching which works across different versions of the binary?
E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
- 61
1
vote
0
answers
40
views
Need help with patching .plt function
I want to patch a .plt function but my friend told me I should use "xref" to find the real caller.
I found it and patched it, Will the .plt function execute?
The function start with PUSH {R4-...
0
votes
2
answers
72
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
2
answers
319
views
How to prevent File Modification in C++
so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
1
vote
1
answer
78
views
Inserting two digits into binary per Hex - without making EXE corrupt
I dont have much knowledge with assemblers. I beg ur pardon in advance.
I need to change an IP address in a win-binary (Net) where the IP its hard-coded.
Just changing the IP with an Hex Editor would ...
- 13
1
vote
0
answers
215
views
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
- 56
1
vote
0
answers
245
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
0
votes
0
answers
69
views
SSL pinning deep problem
I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
- 1
1
vote
1
answer
2k
views
Bypass USB key activation of a software
(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it)
I am asked by a spa store to "do something" to make a ...
- 11
1
vote
0
answers
189
views
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...
I have a .ipa file (iOS application) that I load into to Hopper Disassembler.
I search for a string to ...
- 11
0
votes
1
answer
172
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 101
0
votes
0
answers
150
views
je change to jne and program issue
I am new to forum and new to programming (total noob).
I am trying to modify a program using ollydbg and x32dbg and while attached to file I make the changes fine and it does what I expected.
My ...
1
vote
0
answers
72
views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
- 111
0
votes
1
answer
72
views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
- 13
3
votes
0
answers
139
views
How to see what has changed in a patched binary?
I am exploring MacOS Deckset app.
It has a trial version available on the official website.
But there's a cracked version available on torrent trackers.
I want to know what was changed by the people ...
3
votes
1
answer
150
views
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
- 33
2
votes
1
answer
184
views
OllyDBG saved executable crashes
I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
- 51
0
votes
1
answer
244
views
How can I mod the built-in software of my digital piano?
I'm curious if anyone has any insight on how I can manipulate or mod the code for the built-in software of a digital piano (specifically the Kawai ES8 - or really any digital piano with a display ...
0
votes
1
answer
675
views
Android app crashes even while not edited, how can I solve it?
Installed an application from google playstore and then transferred to it my computer to apparently edit it and without any changes I made to it then I tried to install it through ADB, well the ...
- 189
2
votes
1
answer
303
views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
- 21
1
vote
2
answers
313
views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
1
vote
1
answer
84
views
Executable code in the same location differs in memory and on disk
I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
- 21
0
votes
0
answers
264
views
tutorial of run-time hacking with Dnspy
Is anybody have good resource or tutorial of run-time hacking or memory hacking with .NET Applications with dnspy.
- 54
0
votes
1
answer
454
views
Patch Arm binary with Ida
In Ida I can patch binary that run on x86 , but not binary that run on Arm.
How can I simply patch binary , change assembly(not only hex) and save to new binary file
- 1
1
vote
1
answer
251
views
How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?
I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:
mov r8d, 0Ah ; lpType
mov ...
- 1,145
1
vote
0
answers
206
views
How to hook eval function in node.js
As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
- 111
0
votes
1
answer
680
views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
1
vote
1
answer
179
views
How to save a binary after patching it in cheat engine?
The title asks it all tho
But cheat engine will not allow you to save the patch binary so
what methods can I try to save it after I patch it in cheat engine?
- 45
2
votes
0
answers
238
views
How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file
I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html
I want to extract the user-interface texts to translate them to my local language.
I found the section containing the texts ...
- 21
0
votes
0
answers
85
views
Alternative APIs to hook instead of messagebox for message pop ups?
So i am reversing an app that pops up a message at some point, but its not doing this using messagebox
i also tried to pause and then run to user code but didn't work, so what are some of the other ...
- 212
0
votes
1
answer
1k
views
How to change the title of a windows GUI app when patching? (the title that usually writes the application name)
So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
- 212
-1
votes
2
answers
286
views
How to add a message box to a PE [closed]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
2
votes
2
answers
454
views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
- 23
2
votes
3
answers
354
views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
- 55
2
votes
2
answers
751
views
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
I came upon this question :
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
and it got me wondering, lets say for some reason some function was not in the IAT of our ...
- 99
3
votes
2
answers
765
views
In reverse engineering, what does it mean to "patch a file"?
I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
- 69
1
vote
1
answer
208
views
Hex editing a program to change variable types
For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.
...
- 15
2
votes
0
answers
729
views
How to export to *.so file after patching in ghidra
I'm using ghidra to patch an *.so file in the Android APK.
While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
- 433
0
votes
0
answers
62
views
Output address path during .exe execution
I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.
It turns out that I have an idea of how I could find out in which ...
- 101