Hot answers tagged

25 votes
Accepted

What kind of code would produce this assemby with loads of jump statements?

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
user avatar
  • 34.6k
9 votes

What kind of code would produce this assemby with loads of jump statements?

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get ...
user avatar
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
user avatar
  • 11.3k
6 votes

Trying To Read Code From Call of Duty

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
user avatar
  • 390
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
user avatar
  • 34.6k
4 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

To get your own image base in 32-bit code, you can do this: mov eax, fs:[30h] mov eax, [eax+8] which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
user avatar
  • 4,511
3 votes

How to change the strings in rdata section of a executable file?

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
user avatar
  • 14.8k
3 votes

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. a IDB file is IDAs primary project/database format its the result of an IDA exe load + analyze run ...
user avatar
  • 251
2 votes
Accepted

Help reading a variable from an address in an executable?

You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related.
user avatar
2 votes

Catch connection string between exe and mdb

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
user avatar
2 votes

How to see all my comments on idb file

What you want is IDA Marker. Alt+M to make a marked comment at current cursor location Ctrl+M to bring up a window showing all marked comments
user avatar
2 votes

How to wrap dump process and execute it in another PC

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to ...
user avatar
2 votes

How to run part of exe file that is being reversed

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...
user avatar
  • 2,908
2 votes

Certain bytes in the memory (RAM) get changed after the program starts. Why?

The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article: https://isc.sans.edu/diary/How+Malware+Defends+Itself+...
user avatar
  • 133
2 votes

Start vs WinMain()

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will ...
user avatar
  • 10.5k
2 votes

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the ...
user avatar
  • 686
1 vote

How to extract machine code from a file(especially executable) in C

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) ...
user avatar
  • 251
1 vote

How to extract machine code from a file(especially executable) in C

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER....
user avatar
  • 14.8k
1 vote
Accepted

How to extract machine code from a file(especially executable) in C

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind ...
user avatar
  • 316
1 vote

What are the way I can reverse engineer an obfuscated C++ program?

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA....
user avatar
  • 11
1 vote

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg
user avatar
1 vote

Force a firmware updater to flash any drive model

You don't need to decompile/recompile it, if you know how to read the assembler code. You just need to find the place in the code, which does the model check, and patch it to let the code execute ...
user avatar
  • 1,750
1 vote

How to create executable (create build) from original decompiled exe?

You cannot simply make pyinstaller gui.py. You should resolve all dependencies: or installing packages using pip, or pulling them from extracted PYZ archive folder. In the PYZ folder you can find all ...
user avatar
1 vote

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

You can extract some file from .exe using pyi-archive_viewer, modify them and put back. But be attention, all files in .exe are compressed using DEFLATE (zlib.compress() - you can watch this in source ...
user avatar
1 vote

How to export function from exe file?

calling functions and procedures from executable file are not easy as dlls. dlls have Export Table that maps address of functions to names or ordinals. so while loading dll with LoadLibrary this table ...
user avatar
  • 131
1 vote

(ILSpy) System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid

If the program runs, it should be possible to dump the module from memory, after it was reconstructed to original state while loading it to memory.
user avatar
  • 133
1 vote
Accepted

I want to decompile a exe and change the code to not need Admin to run

Actually this has nothing to do with decompiling and little with reverse engineering. What you need to do is to change level="requireAdministrator" into level="asInvoker": <requestedPrivileges>...
user avatar
  • 10.5k
1 vote

Why doesn't IDA break on the WriteFile function?

A few possibilities come to mind: The application did not use WriteFile but some other API to write. one of the other APIs or one of the DLLs used by the program called WriteFile indirectly. You can ...
user avatar
  • 34.6k
1 vote
Accepted

Change URL a program sends data to

The best way to find this URL is looking into EXE with disassembler like IDA(you can use free version for this). It will disassemble EXE and then you can search for this string. If URL really isn't ...
user avatar
1 vote
Accepted

Is it possible to extract / read a variable out of a running .exe file?

Look into ReadProcessMemory WinAPI, alternatively CheatEngine is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.). You could also search on ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible