6
votes
Accepted
How can I modify binary image resource data?
Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:
RCDATA defines a raw data resource for an application. Raw data resources
permit the inclusion of binary ...
- 8,629
5
votes
Change binary without damage
If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
- 2,154
5
votes
translate arm instructions to hex
as i commented to Elians post rasm2 works in windows as is
rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0
you can use keystone / capstone to assemble and disassemble
:\>python
>...
- 14.9k
4
votes
How to extract firmware from a chip ( snarfing)
Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU.
If it's still the CPU, that you want to dump, read the ...
- 1,750
4
votes
Edit an .so file
Yes, it is possible. Although you could solve your problem in several ways, I'll provide you with the easiest one in my opinion. The tool you could use is objcopy. It allows you to change contents of ...
- 3,189
3
votes
Accepted
Open unknown image format (probably a RAW image)
Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format.
The general structure seems to consist of number of records each with a single '...
- 2,164
3
votes
Accepted
Trying to rip the sprites of this game
Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
- 2,274
3
votes
Accepted
edit CMD exe to not wait for confimation
Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)
Find the string you are looking for in memory e.g. 'press enter ...'
Look up the cross references to find the place in memory ...
- 2,826
3
votes
Bypassing av signature with Hex editing
I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
- 467
2
votes
How to prevent File Modification in C++
You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-...
- 21
2
votes
Accepted
Edit an .so file
Note: My original answer was formulated without an access to the file you wanted to modify, so here comes another one, based on the file you have uploaded.
In the case you want to modify data in the ...
- 3,189
2
votes
Accepted
Modifying a string in a .net binary
C# encodes its string literals as UTF-16.
(http://csharpindepth.com/Articles/General/Strings.aspx)
To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are ...
- 51
2
votes
How can I create an appropriate Japanese .tbl file for Hex Editing?
Windows executables can have text in one of two formats:
UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text ...
- 34.7k
2
votes
translate arm instructions to hex
For this exact purpose I highly suggest using a command line tool such as rasm2.
It is a tool that comes with the radare2 suite. One of it's basic capabilities is translating assembly instructions in ...
- 364
2
votes
Accepted
Windows 10 will not run hex edited application
I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.
- 204
1
vote
Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes
Here's my go to in Python3: bytes.fromhex('020a0d')
From there you can interpret how you'd like.
Python 3.7.6 (default, Dec 30 2019, 19:38:26)
>>> hex_str = '020a0d'
>>> bytes....
- 798
1
vote
ELF binary corrupted after adding instruction in non-executable section
Note that no section information is provided in your question. LOAD0 and LOAD1 refer to loadable segments. Refer to the SysV ABI for more details.
From what I know, the linking step had been ...
- 6,859
1
vote
Patching branch on assembly code
I took Your code inserted some #defines that are needed to compile arm in vc2017 community dev prompt
modified your printall() to main() so that there is an entry point defined
inserted a call to ...
- 14.9k
1
vote
Accepted
Dolphin Emulator Android port modifications
After I did some more digging in the APK, I found what handles the fylesystem for the emulator. It is the libmain.so binary. Because it is handled by this file, modifying it is next to imposdible, ...
- 183
1
vote
Accepted
Dumpout Process Memory Layout During Loading Time
I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example:
http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx
...
- 299
Only top scored, non community-wiki answers of a minimum length are eligible