6 votes
Accepted

How can I modify binary image resource data?

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN: RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary ...
user avatar
  • 8,629
5 votes

Change binary without damage

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
user avatar
  • 2,154
5 votes

translate arm instructions to hex

as i commented to Elians post rasm2 works in windows as is rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0 you can use keystone / capstone to assemble and disassemble :\>python >...
user avatar
  • 14.9k
4 votes

How to extract firmware from a chip ( snarfing)

Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU. If it's still the CPU, that you want to dump, read the ...
user avatar
  • 1,750
4 votes

Edit an .so file

Yes, it is possible. Although you could solve your problem in several ways, I'll provide you with the easiest one in my opinion. The tool you could use is objcopy. It allows you to change contents of ...
user avatar
  • 3,189
3 votes
Accepted

Open unknown image format (probably a RAW image)

Based on those images, this appears to be a fairly straight-forward run-length encoded 32-bits-per-pixel bitmap format. The general structure seems to consist of number of records each with a single '...
user avatar
  • 2,164
3 votes
Accepted

Trying to rip the sprites of this game

Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the other important ...
user avatar
  • 2,274
3 votes
Accepted

edit CMD exe to not wait for confimation

Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..) Find the string you are looking for in memory e.g. 'press enter ...' Look up the cross references to find the place in memory ...
user avatar
  • 2,826
3 votes

Bypassing av signature with Hex editing

I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could ...
user avatar
  • 467
2 votes

How to prevent File Modification in C++

You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-...
user avatar
  • 21
2 votes
Accepted

Edit an .so file

Note: My original answer was formulated without an access to the file you wanted to modify, so here comes another one, based on the file you have uploaded. In the case you want to modify data in the ...
user avatar
  • 3,189
2 votes
Accepted

Modifying a string in a .net binary

C# encodes its string literals as UTF-16. (http://csharpindepth.com/Articles/General/Strings.aspx) To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are ...
user avatar
2 votes

How can I create an appropriate Japanese .tbl file for Hex Editing?

Windows executables can have text in one of two formats: UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text ...
user avatar
  • 34.7k
2 votes

translate arm instructions to hex

For this exact purpose I highly suggest using a command line tool such as rasm2. It is a tool that comes with the radare2 suite. One of it's basic capabilities is translating assembly instructions in ...
user avatar
2 votes
Accepted

Windows 10 will not run hex edited application

I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.
user avatar
1 vote

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

Here's my go to in Python3: bytes.fromhex('020a0d') From there you can interpret how you'd like. Python 3.7.6 (default, Dec 30 2019, 19:38:26) >>> hex_str = '020a0d' >>> bytes....
user avatar
1 vote

ELF binary corrupted after adding instruction in non-executable section

Note that no section information is provided in your question. LOAD0 and LOAD1 refer to loadable segments. Refer to the SysV ABI for more details. From what I know, the linking step had been ...
user avatar
  • 6,859
1 vote

Patching branch on assembly code

I took Your code inserted some #defines that are needed to compile arm in vc2017 community dev prompt modified your printall() to main() so that there is an entry point defined inserted a call to ...
user avatar
  • 14.9k
1 vote
Accepted

Dolphin Emulator Android port modifications

After I did some more digging in the APK, I found what handles the fylesystem for the emulator. It is the libmain.so binary. Because it is handled by this file, modifying it is next to imposdible, ...
user avatar
1 vote
Accepted

Dumpout Process Memory Layout During Loading Time

I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example: http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible