6
Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:
RCDATA defines a raw data resource for an application. Raw data resources
permit the inclusion of binary data directly in the executable file.
nameID RCDATA [optional-statements] {raw-data ...}
raw-data
Raw data consisting of one or more integers ...
5
If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in place of unneeded bytes) or equal to the number of bytes of an instruction or group of instructions that you'd like to patch.
Take this instruction, for example:...
5
as i commented to Elians post rasm2 works in windows as is
rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0
you can use keystone / capstone to assemble and disassemble
:\>python
>>> from keystone import *
>>> for i in (Ks(KS_ARCH_ARM,KS_MODE_ARM).asm ("add R0,R1,R2" , 0x400000) )[0]:
... print "%02x " % i
...
02
00
81
...
4
Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU.
If it's still the CPU, that you want to dump, read the datasheet for the chip to learn how it's programmed and which hardware you need to connect to the chip (JTAG atapter most probably)
Find if there are 'test points' on ...
4
Yes, it is possible. Although you could solve your problem in several ways, I'll provide you with the easiest one in my opinion. The tool you could use is objcopy. It allows you to change contents of ELF files and I'll show you step-by-step example how to use it to achieve your goal. In the example presented below, I'm working on 64bit Linux machine.
...
3
Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format.
The general structure seems to consist of number of records each with a single 'tag' byte followed by a multiple of 4 bytes of RGBA data. These records appear to encapsulate pixel data only, with no dimensions or other metadata.
The ...
3
Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important data, its width and height, are not stored in the file.)
Palette
The palette is a 5 bits per channel BGR, with the highest bit unused. The two bytes are ...
3
Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)
Find the string you are looking for in memory e.g. 'press enter ...'
Look up the cross references to find the place in memory it's used for an API call
Skip that part (look at later or earlier branches to patch, or just patch the bytes to jmp to the end / maybe a return will do the ...
3
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could be editing the .text PE section and editing an essential part of the program rather than .idata or .data section which just store variable data.
So, few methods ...
2
You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-made antitampering routine.
Even those advanced methods become eventually studied and cracked.
Either you have to rely on commercial protections (maybe ...
2
Note: My original answer was formulated without an access to the file you wanted to modify, so here comes another one, based on the file you have uploaded.
In the case you want to modify data in the program, it's essential to get grasp on how (and where) it is accessed. In your case, there are three section involved:
.data
.data.rel.ro
.rodata
.data
All ...
2
C# encodes its string literals as UTF-16.
(http://csharpindepth.com/Articles/General/Strings.aspx)
To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are able to search your string.
If you are able to then change your string to the correct character without breaking UTF-16 and file size then your new string ...
2
Windows executables can have text in one of two formats:
UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text in them is usually present in Unicode (UTF-16) encoding. Resources can be decompiled and edited by tools such as resource editors and easily replaced, usually ...
2
For this exact purpose I highly suggest using a command line tool such as rasm2.
It is a tool that comes with the radare2 suite. One of it's basic capabilities is translating assembly instructions in various architectures to opcodes and vice versa.
The usage is fairly simple:
# rasm2 -a arm -b 32 "add R0, R1, R2"
020081e0
Here:
-a specifies the ...
2
I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.
1
Here's my go to in Python3: bytes.fromhex('020a0d')
From there you can interpret how you'd like.
Python 3.7.6 (default, Dec 30 2019, 19:38:26)
>>> hex_str = '020a0d'
>>> bytes.fromhex(hex_str)
b'\x02\n\r'
>>>
As an aside, I've found that storing things as ASCII Hex is one of the better RE habits I've gotten into. You can share ...
1
Note that no section information is provided in your question. LOAD0 and LOAD1 refer to loadable segments. Refer to the SysV ABI for more details.
From what I know, the linking step had been performed at the compilation/linking of the original source code, so how does it come that ld is involved here ?
The link editor ld is not involved here; rather, the ...
1
I took Your code inserted some #defines that are needed to compile arm in vc2017 community dev prompt
modified your printall() to main() so that there is an entry point defined
inserted a call to F() so that it is easily identifiable and loaded the compiled exe into radare2
modified code
//#defines to make vs2017 community build arm
// need to pass ...
1
After I did some more digging in the APK, I found what handles the fylesystem for the emulator. It is the libmain.so binary. Because it is handled by this file, modifying it is next to imposdible, this is because .so files are akin to windiws .dll binaries and are signed. Since modifying the file is not really an option, the only alternative answer to ...
1
I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example:
http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx
Another option could be to use gdb for do that, for example you have the possibility to set a pending breakpoint to foo and then run the program.
Another option ...
Only top voted, non community-wiki answers of a minimum length are eligible