Questions tagged [patching]
Patching is the process of adding or deleting code from an executable file in order to modify its functioning.
136
questions
1
vote
2
answers
158
views
Edit arm thumb2 intelhex file
I have intelhex file to arm 32 bits thumb 2.
I want edit this file add/ change instructions.
Looking for easy and free tool (prefer gui windows tool ) to do it please.
CommunityBot
- 1
1
vote
0
answers
72
views
How to patch instruction with a call to a thunk function?
I started to use ghidra to begin doing some crackmes, and I need to change an instruction to a call to a thunk function. However, when I export the program back, I get a segfault.
Inspecting it with ...
- 111
1
vote
2
answers
332
views
Changing the jne to je instruction causes program to generate error
I'm trying to change the instruction from jne to je
I've change an instruction
75 0c jne [some_location]
75 0c is a 2 jump instruction.
So, I've a chaged it to from 75 0c to 74 0c which is ...
CommunityBot
- 1
1
vote
1
answer
66
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
CommunityBot
- 1
2
votes
0
answers
35
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
3
votes
2
answers
728
views
Convert Mach-O VM Address To File Offset
this maybe total no brainer but i'm really new to this and i'd really appreciate some help!
Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
0
votes
1
answer
1k
views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
- 10.8k
2
votes
0
answers
29
views
Finding a check in Chrome
Chrome doesn't allow switching on extensions which are not from the Chrome store.
There is no this limitation in Chromium. So it is only in Chrome.
It checks verified_contents.json (in which content ...
- 163
1
vote
0
answers
29
views
How can I create a patch to insert a menu into an executable file which does not have a menu? [duplicate]
I need help writing a patch that inserts a menu into an application which does not have one. When I an executable file in a resource editor, I found the menu and I saved the file again and it doesn't ...
- 31
3
votes
2
answers
401
views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
CommunityBot
- 1
1
vote
0
answers
136
views
IDA binary patch "has no file mapping"
I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
- 11
1
vote
0
answers
58
views
Patched Mac application throws "Invalid value of (null) for entitlement" when running it
I have patched a specific application that I downloaded from the app store but when I ran the executable, it gave me a signal kill 9. I also reverted back the change I made, but the same error was ...
- 11
0
votes
0
answers
32
views
How to prevent dynamic loader from modifying binary in memory?
I have patched a loadable object (an .so file) from this:
xor eax,0x304b7c0
to this:
mov eax,0x0
When I try to run my binary with these modifications, the application loads the .so file and then it ...
1
vote
1
answer
43
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 8,713
0
votes
1
answer
200
views
Hex editing an IP address of a different length
I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
- 786
13
votes
2
answers
5k
views
How do the internals of a Windows update security patch work?
Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.
I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
- 111
1
vote
0
answers
73
views
Patching out relative calls to DLL functions
I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
- 23
2
votes
0
answers
34
views
How to patch bootstrap in NAND flash?
I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC
I read/write that flash.
How can I analyze the bootstrap and change ...
- 171
1
vote
1
answer
100
views
ApplyPatches to input file via IDC
Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
- 166
2
votes
2
answers
1k
views
IDAPython Code <-> Data
I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'.
For example convert this:
.text:00401008 unk_401008 db 55h ; U ; ...
- 266
0
votes
2
answers
161
views
IDA/Olly changing address bytes after patch during debugging on x86
I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing:
BE E4732201 MOV ESI,App.012273E4
should ...
- 15.8k
5
votes
0
answers
321
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
0
votes
1
answer
828
views
Change global variable value in IDA
I have a global variable stored in the data section:
data:00007FF7DDBF78E4 00 00 00 00 dword_7FF7DDBF78E4 dd 0
Is there a way to change its value?
- 11.7k
1
vote
1
answer
327
views
Binary diff + patching across versions
What are the current options for binary patching which works across different versions of the binary?
E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
- 1,707
1
vote
0
answers
40
views
Need help with patching .plt function
I want to patch a .plt function but my friend told me I should use "xref" to find the real caller.
I found it and patched it, Will the .plt function execute?
The function start with PUSH {R4-...
- 11.7k
2
votes
2
answers
10k
views
edit instructions directly in visual mode
I know we can edit opcodes in radare2's visual mode using i.
But is there any way to edit instructions directly in visual mode?
In my case, the instruction is:
jae 0x8048450
And I want change it to:
...
- 117
0
votes
2
answers
459
views
How to prevent File Modification in C++
so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
- 1,080
1
vote
0
answers
303
views
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
5
votes
2
answers
2k
views
Patching a Mach-O Binary Header to remove a LC_SEGMENT
i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection.
more information here under point 3. of preventing dyld injection....
- 137
0
votes
2
answers
110
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
- 15.8k
1
vote
1
answer
115
views
Inserting two digits into binary per Hex - without making EXE corrupt
I dont have much knowledge with assemblers. I beg ur pardon in advance.
I need to change an IP address in a win-binary (Net) where the IP its hard-coded.
Just changing the IP with an Hex Editor would ...
- 699
8
votes
3
answers
2k
views
Ripping/pasting code into an executable using Olly
I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.
Originally, I had an executable that was meant to accept two command line parameters and ...
- 1,080
1
vote
1
answer
3k
views
Bypass USB key activation of a software
(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it)
I am asked by a spa store to "do something" to make a ...
- 1,080
0
votes
1
answer
659
views
How to patch file by adding a branch instruction to another address in arm
I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.
The original file has:
__text:00017B60 loc_17B60 ; ...
1
vote
0
answers
422
views
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.
I figured out that I can directly manipulate IL instructions if I just find ...
- 111
0
votes
0
answers
73
views
SSL pinning deep problem
I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
- 11
1
vote
0
answers
532
views
Static binary instrumentation tools for android .so libraries?
I'm trying to statically inject code into an android app.
The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
2
votes
0
answers
249
views
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...
I have a .ipa file (iOS application) that I load into to Hopper Disassembler.
I search for a string to ...
- 21
-1
votes
2
answers
6k
views
Make this function return true
Sorry, I'm quite new to assembly, and I'm trying to make the code bellow return true:
.text:1000E3E0 ; =============== S U B R O U T I N E =======================================
.text:1000E3E0
.text:...
- 161
0
votes
1
answer
239
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 1,205
1
vote
2
answers
8k
views
How to add code to compiled java class
I have java code that is compiled to a .class file.
There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y)
I want to add to this .class file code that ...
- 141
13
votes
3
answers
21k
views
Remove code signature from a Mac binary
How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards?
Needless to say, I'm not the original creator of the binary, nor I have the ...
0
votes
0
answers
192
views
je change to jne and program issue
I am new to forum and new to programming (total noob).
I am trying to modify a program using ollydbg and x32dbg and while attached to file I make the changes fine and it does what I expected.
My ...
- 1
1
vote
0
answers
96
views
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.
In an effort to save time writing and debugging assembly, I took the following no-...
- 111
4
votes
5
answers
8k
views
Making application load dll at start
I've added some functionality to existing application which works through dll injection - my dll loads and patches some stuff.
I would like it to be added to this application permanently so I don't ...
- 266
0
votes
1
answer
115
views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
- 96
1
vote
3
answers
1k
views
Remove a mutex on windows (with debugger/disassembler)
I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with a program ...
- 10.8k
2
votes
2
answers
728
views
Is there a way to tell the IDA debugger to apply all patches from the database?
I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
- 35.8k
3
votes
1
answer
162
views
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
- 10.8k
3
votes
0
answers
143
views
How to see what has changed in a patched binary?
I am exploring MacOS Deckset app.
It has a trial version available on the official website.
But there's a cracked version available on torrent trackers.
I want to know what was changed by the people ...
