6
votes
Change binary without damage
If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
- 2,234
6
votes
Accepted
How can I modify binary image resource data?
Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:
RCDATA defines a raw data resource for an application. Raw data resources
permit the inclusion of binary ...
- 8,919
5
votes
translate arm instructions to hex
as i commented to Elians post rasm2 works in windows as is
rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0
you can use keystone / capstone to assemble and disassemble
:\>python
>...
- 16.3k
4
votes
Edit an .so file
Yes, it is possible. Although you could solve your problem in several ways, I'll provide you with the easiest one in my opinion. The tool you could use is objcopy. It allows you to change contents of ...
- 3,369
4
votes
How to extract firmware from a chip ( snarfing)
Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU.
If it's still the CPU, that you want to dump, read the ...
- 1,840
3
votes
Accepted
Open unknown image format (probably a RAW image)
Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format.
The general structure seems to consist of number of records each with a single '...
- 2,503
3
votes
Accepted
Trying to rip the sprites of this game
Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
- 2,354
3
votes
Accepted
edit CMD exe to not wait for confimation
Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)
Find the string you are looking for in memory e.g. 'press enter ...'
Look up the cross references to find the place in memory ...
- 2,896
3
votes
Bypassing av signature with Hex editing
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
- 467
2
votes
Accepted
Modifying a string in a .net binary
C# encodes its string literals as UTF-16.
(http://csharpindepth.com/Articles/General/Strings.aspx)
To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are ...
- 51
2
votes
How can I create an appropriate Japanese .tbl file for Hex Editing?
Windows executables can have text in one of two formats:
UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text ...
- 36.4k
2
votes
translate arm instructions to hex
For this exact purpose I highly suggest using a command line tool such as rasm2.
It is a tool that comes with the radare2 suite. One of it's basic capabilities is translating assembly instructions in ...
- 364
2
votes
Accepted
Windows 10 will not run hex edited application
I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.
- 204
2
votes
How to prevent File Modification in C++
You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-...
- 21
2
votes
Accepted
Edit an .so file
Note: My original answer was formulated without an access to the file you wanted to modify, so here comes another one, based on the file you have uploaded.
In the case you want to modify data in the ...
- 3,369
1
vote
Modifying a single .class file in an obfuscated JAR
I made Recaf.
I can use Recaf, it will decompile it well and I can save modifications and export program without issues.
The title and later description seems to imply the code is obfuscated. Please ...
- 128
1
vote
Editing Binary File with Hex Editor
I would say it is unlikely to be security protection... most likely you broke the binary when you edited it. Try running it under a debugger to see where/how it dies.
- 796
1
vote
Accepted
Reversing Games like Manfred dis
Manfred has 20+ years of experience and many skills, so don't expect to get there overnight. As a starting point:
Read Beej's guides: https://beej.us/guide/bgnet/
Write a client and server, use a ...
- 796
1
vote
Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes
Here's my go to in Python3: bytes.fromhex('020a0d')
From there you can interpret how you'd like.
Python 3.7.6 (default, Dec 30 2019, 19:38:26)
>>> hex_str = '020a0d'
>>> bytes....
- 878
1
vote
ELF binary corrupted after adding instruction in non-executable section
Note that no section information is provided in your question. LOAD0 and LOAD1 refer to loadable segments. Refer to the SysV ABI for more details.
From what I know, the linking step had been ...
- 7,078
1
vote
Edit arm thumb2 intelhex file
If you dont mind it being python instead, I think you could do something pretty easily by combining the bincopy library (for the conversions to/from) and Capstone/Keystone for disassembling the old ...
- 154
1
vote
Edit arm thumb2 intelhex file
Convert from hex to bin, patch it, then convert it back. The main issue is that in HEX format there will be the base address, and you need to specify it when converting back.
Don't know any GUI tool, ...
- 1,840
1
vote
Patching branch on assembly code
I took Your code inserted some #defines that are needed to compile arm in vc2017 community dev prompt
modified your printall() to main() so that there is an entry point defined
inserted a call to ...
- 16.3k
1
vote
Accepted
Dolphin Emulator Android port modifications
After I did some more digging in the APK, I found what handles the fylesystem for the emulator. It is the libmain.so binary. Because it is handled by this file, modifying it is next to imposdible, ...
- 193
1
vote
Accepted
Dumpout Process Memory Layout During Loading Time
I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example:
http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx
...
- 309
Only top scored, non community-wiki answers of a minimum length are eligible