Questions tagged [patching]
Patching is the process of adding or deleting code from an executable file in order to modify its functioning.
137
questions
13
votes
3
answers
21k
views
Remove code signature from a Mac binary
How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards?
Needless to say, I'm not the original creator of the binary, nor I have the ...
- 287
13
votes
2
answers
5k
views
How do the internals of a Windows update security patch work?
Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.
I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
- 1,226
9
votes
1
answer
4k
views
IDA Pro: What does "Create EXE file..." option do?
I have come across File -> Create EXE file... option in IDA. I thought one couldn't use IDA for patching. I have tried playing with it. However, it gives me the following error: This type of output ...
- 3,068
8
votes
3
answers
2k
views
Ripping/pasting code into an executable using Olly
I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.
Originally, I had an executable that was meant to accept two command line parameters and ...
- 1,022
7
votes
3
answers
4k
views
Patching a .Net 4.0 Binary in Olly or CFF Explorer
I have a challenge compiled in C# .net 4.0. I can see the source completely fine in Reflector. I'd like to change the source. I guess I do this by patching some bytes in the binary.
The problem I'm ...
- 71
7
votes
2
answers
2k
views
Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE
As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
- 113
5
votes
4
answers
2k
views
Are there any modern assembly-level patching tools?
I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is ...
- 53
5
votes
1
answer
882
views
Replacing small length instruction with larger length instruction
Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.
I am using IDA Pro for analyzing native ...
- 165
5
votes
1
answer
427
views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
- 51
5
votes
2
answers
2k
views
Patching a Mach-O Binary Header to remove a LC_SEGMENT
i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection.
more information here under point 3. of preventing dyld injection....
- 183
5
votes
0
answers
329
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
4
votes
5
answers
8k
views
Making application load dll at start
I've added some functionality to existing application which works through dll injection - my dll loads and patches some stuff.
I would like it to be added to this application permanently so I don't ...
- 95
4
votes
2
answers
234
views
What's the best way of improving already compiled binary?
Like if I want to patch a function in a PE.
Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
- 445
4
votes
2
answers
10k
views
Workflow patching Java jar file
Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch.
With ...
- 339
4
votes
2
answers
10k
views
How to edit and modify a class with ILSpy + Reflexil
In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g.
There is this in :
if (isCrackedResult != null && isCrackedResult.IsCracked)
and I want to modify for this :
if (...
- 41
4
votes
1
answer
3k
views
In-memory patching of .net code
Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
- 155
4
votes
1
answer
841
views
Are PATCH shims (.sdb's) no longer functional in Windows 10?
No matter what I do, I can't seem to be able to get my Windows 10 (64-bit, build 1607) to apply any patches in custom SDB's (as described in the article of Jon Erickson from 2014).
I'm using Jon's ...
- 173
4
votes
1
answer
606
views
ELF counterpart for IDA Pro PE utilities
I'm interested in patching ELF files using IDA and the following PE utilities have proven very useful for patching PEs.
Does anyone know if there are some publicly available IDA scripts similar to ...
- 828
4
votes
1
answer
3k
views
Injecting shellcode in ELF binary
I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am ...
- 1,311
3
votes
3
answers
2k
views
Insert logging into existing binary code, ARM
I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.)
Does ...
3
votes
1
answer
2k
views
Getting Access Violation when patching a program
I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error.
I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code:
...
- 33
3
votes
1
answer
162
views
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
- 33
3
votes
2
answers
936
views
In reverse engineering, what does it mean to "patch a file"?
I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
- 69
3
votes
1
answer
790
views
How can I create an appropriate Japanese .tbl file for Hex Editing?
I'm trying to edit a Japanese Configuration executable using Resource Hacker and I just want to translate the UI stuff to English. There are also a few English text that I was able to find and ...
- 31
3
votes
2
answers
729
views
Convert Mach-O VM Address To File Offset
this maybe total no brainer but i'm really new to this and i'd really appreciate some help!
Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
- 183
3
votes
1
answer
392
views
Ollydbg 2.1 Allow for multiple saves or not make backups
I have been looking all around for an answer to this, so I am hoping I find an answer here.
I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, ...
- 773
3
votes
2
answers
403
views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
- 65
3
votes
1
answer
240
views
How to update the injected calls' address after patching binary?
After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
- 141
3
votes
0
answers
36
views
How to patch bootstrap in NAND flash?
I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC
I read/write that flash.
How can I analyze the bootstrap and change ...
- 181
3
votes
0
answers
143
views
How to see what has changed in a patched binary?
I am exploring MacOS Deckset app.
It has a trial version available on the official website.
But there's a cracked version available on torrent trackers.
I want to know what was changed by the people ...
3
votes
0
answers
92
views
Any way to edit an ELF binary without hex? [duplicate]
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.
I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
- 131
2
votes
2
answers
2k
views
translate arm instructions to hex
I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/.
Without linker , I want put 1 instruction , and want get the hex .
Do you know one please?
2
votes
2
answers
895
views
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
I came upon this question :
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
and it got me wondering, lets say for some reason some function was not in the IAT of our ...
- 99
2
votes
2
answers
1k
views
IDAPython Code <-> Data
I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'.
For example convert this:
.text:00401008 unk_401008 db 55h ; U ; ...
- 111
2
votes
2
answers
4k
views
Patching a class file inside Jar using bytecode
I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class ...
- 63
2
votes
2
answers
10k
views
edit instructions directly in visual mode
I know we can edit opcodes in radare2's visual mode using i.
But is there any way to edit instructions directly in visual mode?
In my case, the instruction is:
jae 0x8048450
And I want change it to:
...
- 91
2
votes
2
answers
527
views
Avoid re-enabling patches between reruns in Ollydbg
In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again.
Is there a menu ...
- 4,755
2
votes
1
answer
214
views
OllyDBG saved executable crashes
I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with ...
- 51
2
votes
2
answers
562
views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
- 23
2
votes
2
answers
730
views
Is there a way to tell the IDA debugger to apply all patches from the database?
I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
- 12.8k
2
votes
1
answer
380
views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
- 21
2
votes
1
answer
146
views
How to write sequence of machine code in radare2?
I know how to write an opcode and how to increment and decrement machine code using plus and minus keys. However, how do I write a sequence of machine code at an offset?
E.g. if I want to write five ...
- 153
2
votes
3
answers
1k
views
How to make a valid patch to bypass self checking security measure?
I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I ...
- 619
2
votes
1
answer
793
views
Turn ¨Assemble¨ option on, in IDA Pro Demo
Is there a way to highlight "assemble" option in EDIT menu at IDA pro to apply a patch. Guess that idagui.cfg must be changed at some point, and turn NO to YES somewhere.
I use the last demo version....
- 21
2
votes
1
answer
2k
views
Get list of functions (including non-exported functions!) in running executable
I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.
For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
- 21
2
votes
1
answer
1k
views
Insert a function call in an ELF executable
I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning.
This answer seems to ...
- 1,311
2
votes
0
answers
35
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
2
votes
0
answers
30
views
Finding a check in Chrome
Chrome doesn't allow switching on extensions which are not from the Chrome store.
There is no this limitation in Chromium. So it is only in Chrome.
It checks verified_contents.json (in which content ...
- 163
2
votes
0
answers
254
views
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...
I have a .ipa file (iOS application) that I load into to Hopper Disassembler.
I search for a string to ...
- 21
2
votes
0
answers
329
views
How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file
I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html
I want to extract the user-interface texts to translate them to my local language.
I found the section containing the texts ...
- 21