Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 1562

Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software.

1
vote
I really want to jump to 005A4AA3. Patch the bytes at virtual address 005A45AF from FF 24 B5 B6 45 5A 00 to E9 EF 04 00 00 90 90. My question is can I modify DS:[ESI*4+5A45B6] to [ESI*4+5A4AA …
answered Oct 4 '15 by Jason Geffner
3
votes
Open the executable file with a hex editor, search for the string "Continue", and overwrite those bytes with the string "Carry on".
answered Sep 3 '15 by Jason Geffner
5
votes
"File Size" is the size of the file on disk, according to the file system. "PE Size" is the value of the SizeOfImage field in the IMAGE_OPTIONAL_HEADER structure in the PE file. Its value is calculat …
answered Mar 1 '16 by Jason Geffner
1
vote
Instead of trying to rebuild the EXE from the .pyc files, you can just use py2exe to build a new EXE from the modified .py files. Alternatively, if you really want to replace the library in the origi …
answered Dec 4 '14 by Jason Geffner
2
votes
Code before This is my string relies on addresses/offsets of data (and possibly code) after This is my string. When you insert the string new, you're effectively shifting the code/data after This is m …
answered Mar 14 '14 by Jason Geffner
2
votes
PatchDiff2 is open-source, so you can edit it yourself to write the output to a file.
answered Jan 3 '14 by Jason Geffner
1
vote
I would like to see the actually files that were patched ... Old-school: Winalysis New-school: Attack Surface Analyzer ... and see what in the code might have been changed and see what the …
answered Feb 13 '16 by Jason Geffner
6
votes
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
answered Aug 28 '15 by Jason Geffner
0
votes
As @user45891 commented, replace DLL1_packed on disk with DLL1_unpacked, and replace DLL2_packed on disk with DLL2_unpacked. (@user45891, feel free to post the same answer as this, and I'll delete my …
answered Nov 22 '14 by Jason Geffner