Questions tagged [patching]

Patching is the process of adding or deleting code from an executable file in order to modify its functioning.

Filter by
Sorted by
Tagged with
1
vote
3answers
663 views

Remove a mutex on windows (with debugger/disassembler)

I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with a program ...
0
votes
2answers
77 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
1answer
2k views

How to patch a binary file and save it? [closed]

I have an ARM executable binary file and I want to patch it at precise virtual addresses. Is there any safe (and automated) way to perform this task ? Any scripts or tools are welcome!
-1
votes
1answer
3k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
1
vote
1answer
5k views

Inject code into exe

I don't know whether this is the right place to ask this question. I want some guide lines on this subject because I don't know how to search my problem in the internet. I want to create an ...
5
votes
1answer
335 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
4
votes
2answers
6k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
4
votes
2answers
178 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
1
vote
1answer
132 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
1
vote
1answer
686 views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
-2
votes
1answer
3k views

Make this function return true

Sorry, I'm quite new to assembly, and I'm trying to make the code bellow return true: .text:1000E3E0 ; =============== S U B R O U T I N E ======================================= .text:1000E3E0 .text:...
0
votes
1answer
490 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
1
vote
1answer
1k views

How to bind two EXE files?

I'm working on a project that needs to be a stand-alone executable but run another executable whenever it is started. Unfortunately I don't have access to the source code of the second program to ...
3
votes
1answer
502 views

How can I create an appropriate Japanese .tbl file for Hex Editing?

I'm trying to edit a Japanese Configuration executable using Resource Hacker and I just want to translate the UI stuff to English. There are also a few English text that I was able to find and ...
2
votes
0answers
224 views

IDA does not follow relative jump, executable patching

I created small C program (x86) with this asm code inside main: __asm { jmp label // EB 02 nop // 90 nop // 90 } label: Loaded it in IDA (in static mode, so ...
1
vote
2answers
4k views

Binary patching using radare2 in debug mode

Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction ...
1
vote
1answer
531 views

patch function in ARM binary to always return 0

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0. The disassembly looks like this STMFD SP!, {R4-...
0
votes
1answer
1k views

Patch packed DLL by themida [closed]

How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size. I ...
1
vote
1answer
659 views

IDA & patching question

I have an app in which I have to manually alter several flags in order to get to the part of the code Im interested in (imagine altering ZF to pass JNZ instruction). I have to do this every time I run ...
4
votes
1answer
717 views

Are PATCH shims (.sdb's) no longer functional in Windows 10?

No matter what I do, I can't seem to be able to get my Windows 10 (64-bit, build 1607) to apply any patches in custom SDB's (as described in the article of Jon Erickson from 2014). I'm using Jon's ...
7
votes
3answers
10k views

Remove code signature from a Mac binary

How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards? Needless to say, I'm not the original creator of the binary, nor I have the ...
3
votes
1answer
1k views

Getting Access Violation when patching a program

I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error. I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code: ...
0
votes
1answer
93 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
1
vote
1answer
930 views

VirtualProtect return value

VirtualProtect is straightforward but I get some results that I can't explain. Something's going on in the background probably but I'd like to know what. The following is under Windows 7 SP1 Ultimate ...
1
vote
0answers
113 views

Patch is detected yet hardware access breakpoint isn't hit

I wonder how is that possible. I found debugger detection in TLS Callback function - there is conditional jump after some check. When I step over it with debugger and modify ZF flag to bypass ...
1
vote
1answer
622 views

Patching Application on OSX (Memory Protection)

I'm patching an executable on OSX. So far I know the patches have been applied successfully. Steps taken (via LLDB): lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test b start run br del 1 ...
1
vote
1answer
288 views

Patching MIPS binary file on IDA fails at build

I'm working on reverse a binary from a MIPS based router. In order to do it I'm emulating the binary with qemu, but the binary executes some routines before stating with the logic that skips the ...
3
votes
1answer
2k views

In-memory patching of .net code

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing ...
4
votes
1answer
2k views

Injecting shellcode in ELF binary

I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am ...
2
votes
1answer
1k views

Insert a function call in an ELF executable

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning. This answer seems to ...
2
votes
3answers
784 views

How to make a valid patch to bypass self checking security measure?

I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I ...
2
votes
2answers
449 views

Avoid re-enabling patches between reruns in Ollydbg

In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again. Is there a menu ...
1
vote
1answer
828 views

Code-Cave Assembly Patching Issue in x64_dbg

I'm trying a code-cave approach to this query that was asked about on this forum earlier. I'm using x64_dbg to perform this task. My issue here is that after I have written the extra lines of ...
1
vote
1answer
1k views

How to add code to Portable Executable?

I have a PE which I'd like to edit. I know I can create patches in OllyDbg and similar tools, but they all have one thing in common: I have to overwrite some present code in file. I wonder if it is ...
1
vote
1answer
483 views

Patch driver loading process [closed]

Introduction Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
1
vote
1answer
115 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
3
votes
1answer
165 views

How to update the injected calls' address after patching binary?

After using IDA analysing a dll file, I replaced a call with another one. That is, replacing CALL xxxx with CALL ds:yyyy. (ds:yyyy has been referenced by other locations already). And I used IDA to ...
0
votes
2answers
503 views

Why use some cracks a patch and a keygen? [closed]

A lot of cracked software in the internet looks like it's liberated with a patched executable and an additional key generator. Why so complicated? If the executable is patched why isn't the necessity ...
5
votes
1answer
727 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
2
votes
1answer
676 views

Turn ¨Assemble¨ option on, in IDA Pro Demo

Is there a way to highlight "assemble" option in EDIT menu at IDA pro to apply a patch. Guess that idagui.cfg must be changed at some point, and turn NO to YES somewhere. I use the last demo version....
4
votes
2answers
7k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
4
votes
2answers
1k views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
1
vote
0answers
76 views

Where to identify and access the main object/closure in a JavaScript web app?

I want to add missing functionality to a web app's front end code JavaScript code. I can find the code in the browser's developer tools by setting breakpoints and stepping through. But in a large ...
2
votes
2answers
551 views

Is there a way to tell the IDA debugger to apply all patches from the database?

I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
1
vote
0answers
444 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
2
votes
1answer
585 views

Convert Mach-O VM Address To File Offset

this maybe total no brainer but i'm really new to this and i'd really appreciate some help! Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
3
votes
5answers
4k views

Making application load dll at start

I've added some functionality to existing application which works through dll injection - my dll loads and patches some stuff. I would like it to be added to this application permanently so I don't ...
5
votes
4answers
2k views

Are there any modern assembly-level patching tools?

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is ...
12
votes
2answers
3k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
3
votes
1answer
319 views

Ollydbg 2.1 Allow for multiple saves or not make backups

I have been looking all around for an answer to this, so I am hoping I find an answer here. I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, ...