Skip to main content
25 votes
Accepted

What kind of code would produce this assemby with loads of jump statements?

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
Igor Skochinsky's user avatar
  • 36.8k
9 votes

What kind of code would produce this assemby with loads of jump statements?

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get ...
ratchet freak's user avatar
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
NirIzr's user avatar
  • 11.8k
7 votes

Trying To Read Code From Call of Duty

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
svick's user avatar
  • 410
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

To get your own image base in 32-bit code, you can do this: mov eax, fs:[30h] mov eax, [eax+8] which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
peter ferrie's user avatar
  • 4,709
4 votes
Accepted

Is there a way to decompress a Fody-Costura generated exe in c#?

Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is ...
Paweł Łukasik's user avatar
3 votes

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. a IDB file is IDAs primary project/database format its the result of an IDA exe load + analyze run ...
llm's user avatar
  • 336
3 votes

How to change the strings in rdata section of a executable file?

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

why some functions push data before the prologue

It's saving registers that might be modified by the function. Notice that you can see assignments to all three of those registers throughout the function body. Also notice at the bottom of your ...
Rolf Rolles's user avatar
  • 9,198
3 votes

How can I extract *.c file hidden in an executable file (SkiFree)

It's not common for executables to include their own source code, so in general, the answer to your question is "that's not possible". That string likely appears in the binary due to some ...
Rolf Rolles's user avatar
  • 9,198
2 votes
Accepted

Help reading a variable from an address in an executable?

You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related.
tylernygaard's user avatar
2 votes
Accepted

Is it possible to extract / read a variable out of a running .exe file?

Look into ReadProcessMemory WinAPI, alternatively CheatEngine is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.). You could also search on ...
Dominik Antal's user avatar
2 votes

Catch connection string between exe and mdb

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
chentiangemalc's user avatar
2 votes

How to see all my comments on idb file

What you want is IDA Marker. Alt+M to make a marked comment at current cursor location Ctrl+M to bring up a window showing all marked comments
yellowbyte's user avatar
2 votes

How to wrap dump process and execute it in another PC

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to ...
knowmalware's user avatar
2 votes

How to run part of exe file that is being reversed

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...
Remko's user avatar
  • 3,273
2 votes

Certain bytes in the memory (RAM) get changed after the program starts. Why?

The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article: https://isc.sans.edu/diary/How+Malware+Defends+Itself+...
MazeGen's user avatar
  • 143
2 votes

Start vs WinMain()

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will ...
0xC0000022L's user avatar
  • 10.9k
2 votes

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the ...
morsisko's user avatar
  • 696
2 votes

Is there a way to decompress a Fody-Costura generated exe in c#?

I had success using the Fody-Costura-Decompress tool. You would need to build the solution from source. it has a simple GUI for choosing your file and decompressing it.
Alenros's user avatar
  • 121
2 votes

How to unpack Armadillo protected software using x64dbg?

I'm not able to comment, so I'll just answer here. If you have to perform the unpacking manually, you should ask yourself - to what extent do you need it unpacked? What are you trying to achieve with ...
Niraeth's user avatar
  • 189
2 votes
Accepted

How can I extract *.c file hidden in an executable file (SkiFree)

the best you can get: https://github.com/yuv422/skifree_decomp A source code reconstruction of the 32bit version of Skifree (v1.04) back to C, compilable with Visual Studio 6. so someone already did ...
llm's user avatar
  • 336
1 vote

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg
user3288107's user avatar
1 vote

Force a firmware updater to flash any drive model

You don't need to decompile/recompile it, if you know how to read the assembler code. You just need to find the place in the code, which does the model check, and patch it to let the code execute ...
Anton Kukoba's user avatar
  • 1,850
1 vote

How to extract machine code from a file(especially executable) in C

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) ...
llm's user avatar
  • 336
1 vote

How to extract machine code from a file(especially executable) in C

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER....
blabb's user avatar
  • 16.4k
1 vote
Accepted

How to extract machine code from a file(especially executable) in C

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind ...
Happy's user avatar
  • 366
1 vote

What are the way I can reverse engineer an obfuscated C++ program?

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA....
argie's user avatar
  • 21
1 vote

How to create executable (create build) from original decompiled exe?

You cannot simply make pyinstaller gui.py. You should resolve all dependencies: or installing packages using pip, or pulling them from extracted PYZ archive folder. In the PYZ folder you can find all ...
 van9petryk's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible