Skip to main content

Questions tagged [patching]

Patching is the process of adding or deleting code from an executable file in order to modify its functioning.

Filter by
Sorted by
Tagged with
14 votes
3 answers
25k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
alexandernst's user avatar
13 votes
2 answers
5k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
MrSynAckSter's user avatar
  • 1,258
9 votes
1 answer
4k views

IDA Pro: What does "Create EXE file..." option do?

I have come across File -> Create EXE file... option in IDA. I thought one couldn't use IDA for patching. I have tried playing with it. However, it gives me the following error: This type of output ...
PSS's user avatar
  • 3,088
8 votes
3 answers
2k views

Ripping/pasting code into an executable using Olly

I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another. Originally, I had an executable that was meant to accept two command line parameters and ...
Fewmitz's user avatar
  • 1,022
7 votes
3 answers
4k views

Patching a .Net 4.0 Binary in Olly or CFF Explorer

I have a challenge compiled in C# .net 4.0. I can see the source completely fine in Reflector. I'd like to change the source. I guess I do this by patching some bytes in the binary. The problem I'm ...
4r4r4r's user avatar
  • 71
7 votes
2 answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
user3546043's user avatar
5 votes
4 answers
2k views

Are there any modern assembly-level patching tools?

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is ...
ultramancool's user avatar
5 votes
2 answers
275 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
rec's user avatar
  • 475
5 votes
2 answers
10k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
user2011659's user avatar
5 votes
1 answer
1k views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
user2578525's user avatar
5 votes
1 answer
448 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
John's user avatar
  • 51
5 votes
2 answers
2k views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
Malte's user avatar
  • 183
5 votes
0 answers
543 views

Patching Jar File (2022)

Currently reversing a .jar program recreationally, and I understand the workflow proposed here: https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
triboulet's user avatar
4 votes
5 answers
9k views

Making application load dll at start

I've added some functionality to existing application which works through dll injection - my dll loads and patches some stuff. I would like it to be added to this application permanently so I don't ...
larw's user avatar
  • 95
4 votes
2 answers
11k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
GeGaX's user avatar
  • 41
4 votes
1 answer
3k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
Andrew Savinykh's user avatar
4 votes
2 answers
1k views

In reverse engineering, what does it mean to "patch a file"?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
unc4nny's user avatar
  • 89
4 votes
1 answer
866 views

Are PATCH shims (.sdb's) no longer functional in Windows 10?

No matter what I do, I can't seem to be able to get my Windows 10 (64-bit, build 1607) to apply any patches in custom SDB's (as described in the article of Jon Erickson from 2014). I'm using Jon's ...
rustyx's user avatar
  • 173
4 votes
1 answer
618 views

ELF counterpart for IDA Pro PE utilities

I'm interested in patching ELF files using IDA and the following PE utilities have proven very useful for patching PEs. Does anyone know if there are some publicly available IDA scripts similar to ...
Benny's user avatar
  • 828
4 votes
1 answer
3k views

Injecting shellcode in ELF binary

I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am ...
sherlock's user avatar
  • 1,381
4 votes
0 answers
93 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
InxaneNinja's user avatar
3 votes
3 answers
2k views

Insert logging into existing binary code, ARM

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.) Does ...
18446744073709551615's user avatar
3 votes
1 answer
2k views

Getting Access Violation when patching a program

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error. I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code: ...
João Telles's user avatar
3 votes
1 answer
171 views

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
chason's user avatar
  • 33
3 votes
1 answer
834 views

How can I create an appropriate Japanese .tbl file for Hex Editing?

I'm trying to edit a Japanese Configuration executable using Resource Hacker and I just want to translate the UI stuff to English. There are also a few English text that I was able to find and ...
Lightpost's user avatar
3 votes
2 answers
802 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
Malte's user avatar
  • 183
3 votes
1 answer
411 views

Ollydbg 2.1 Allow for multiple saves or not make backups

I have been looking all around for an answer to this, so I am hoping I find an answer here. I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, ...
LUser's user avatar
  • 793
3 votes
2 answers
456 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
FiftyTifty's user avatar
3 votes
1 answer
258 views

How to update the injected calls' address after patching binary?

After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
haohaolee's user avatar
  • 141
3 votes
0 answers
41 views

How to patch bootstrap in NAND flash?

I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC I read/write that flash. How can I analyze the bootstrap and change ...
Kokomelom's user avatar
  • 281
3 votes
0 answers
159 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
Revengo Engineros's user avatar
2 votes
2 answers
3k views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
ivn23744sawoe.com's user avatar
2 votes
2 answers
1k views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
Max's user avatar
  • 99
2 votes
2 answers
2k views

IDAPython Code <-> Data

I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'. For example convert this: .text:00401008 unk_401008 db 55h ; U ; ...
eXp's user avatar
  • 111
2 votes
2 answers
5k views

Patching a class file inside Jar using bytecode

I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
sks15's user avatar
  • 63
2 votes
2 answers
10k views

edit instructions directly in visual mode

I know we can edit opcodes in radare2's visual mode using i. But is there any way to edit instructions directly in visual mode? In my case, the instruction is: jae 0x8048450 And I want change it to: ...
ali's user avatar
  • 91
2 votes
2 answers
543 views

Avoid re-enabling patches between reruns in Ollydbg

In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again. Is there a menu ...
Mellowcandle's user avatar
  • 4,825
2 votes
1 answer
261 views

OllyDBG saved executable crashes

I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
skudo's user avatar
  • 51
2 votes
2 answers
690 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
Fergo's user avatar
  • 23
2 votes
2 answers
783 views

Is there a way to tell the IDA debugger to apply all patches from the database?

I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
Guntram Blohm's user avatar
2 votes
1 answer
445 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
2 votes
1 answer
161 views

How to write sequence of machine code in radare2?

I know how to write an opcode and how to increment and decrement machine code using plus and minus keys. However, how do I write a sequence of machine code at an offset? E.g. if I want to write five ...
AlphaCentauri's user avatar
2 votes
3 answers
1k views

How to make a valid patch to bypass self checking security measure?

I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I ...
FreeMind's user avatar
  • 639
2 votes
1 answer
830 views

Turn ¨Assemble¨ option on, in IDA Pro Demo

Is there a way to highlight "assemble" option in EDIT menu at IDA pro to apply a patch. Guess that idagui.cfg must be changed at some point, and turn NO to YES somewhere. I use the last demo version....
danielsoy's user avatar
2 votes
1 answer
214 views

ApplyPatches to input file via IDC

Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
Kirill Kirillov's user avatar
2 votes
1 answer
2k views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
Zatherz's user avatar
  • 21
2 votes
1 answer
1k views

Insert a function call in an ELF executable

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning. This answer seems to ...
sherlock's user avatar
  • 1,381
2 votes
0 answers
44 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
Redouane Red's user avatar
2 votes
0 answers
38 views

Finding a check in Chrome

Chrome doesn't allow switching on extensions which are not from the Chrome store. There is no this limitation in Chromium. So it is only in Chrome. It checks verified_contents.json (in which content ...
oleedd's user avatar
  • 163
2 votes
0 answers
321 views

Automating binary patching in Hopper Disassembler using python

I am curious to know if anyone has done anything similar to what I am looking to achieve... I have a .ipa file (iOS application) that I load into to Hopper Disassembler. I search for a string to ...
user35324's user avatar