25
votes
Accepted
What kind of code would produce this assemby with loads of jump statements?
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
- 36.4k
9
votes
What kind of code would produce this assemby with loads of jump statements?
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get ...
- 617
8
votes
Accepted
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
- 11.7k
7
votes
Trying To Read Code From Call of Duty
Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
- 400
5
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c):
BOOL __cdecl ...
- 36.4k
4
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
To get your own image base in 32-bit code, you can do this:
mov eax, fs:[30h]
mov eax, [eax+8]
which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
- 4,701
4
votes
Accepted
Is there a way to decompress a Fody-Costura generated exe in c#?
Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is ...
- 4,912
3
votes
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA.
a IDB file is IDAs primary project/database format
its the result of an IDA exe load + analyze run
...
- 336
3
votes
How to change the strings in rdata section of a executable file?
it is a tough and tedious task and completely error prone
assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
- 16.3k
3
votes
Accepted
why some functions push data before the prologue
It's saving registers that might be modified by the function. Notice that you can see assignments to all three of those registers throughout the function body. Also notice at the bottom of your ...
- 9,178
3
votes
How can I extract *.c file hidden in an executable file (SkiFree)
It's not common for executables to include their own source code, so in general, the answer to your question is "that's not possible". That string likely appears in the binary due to some ...
- 9,178
2
votes
Accepted
Help reading a variable from an address in an executable?
You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related.
- 58
2
votes
Accepted
Is it possible to extract / read a variable out of a running .exe file?
Look into ReadProcessMemory WinAPI, alternatively CheatEngine is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.).
You could also search on ...
- 2,038
2
votes
Catch connection string between exe and mdb
You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...
- 1,235
2
votes
How to see all my comments on idb file
What you want is IDA Marker.
Alt+M to make a marked comment at current cursor location
Ctrl+M to bring up a window showing all marked comments
- 186
2
votes
How to wrap dump process and execute it in another PC
If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to ...
- 336
2
votes
How to run part of exe file that is being reversed
You can use Ida's Appcall functionality:
Appcall is a mechanism to call functions inside the debugged program
from the debugger or your script as if it were a built-in function.
Such a ...
- 3,208
2
votes
Certain bytes in the memory (RAM) get changed after the program starts. Why?
The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article:
https://isc.sans.edu/diary/How+Malware+Defends+Itself+...
- 143
2
votes
Start vs WinMain()
First, please read this.
Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will ...
- 10.9k
2
votes
How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)
Generic answer:
When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the ...
- 696
2
votes
Is there a way to decompress a Fody-Costura generated exe in c#?
I had success using the Fody-Costura-Decompress tool.
You would need to build the solution from source. it has a simple GUI for choosing your file and decompressing it.
- 121
2
votes
How to unpack Armadillo protected software using x64dbg?
I'm not able to comment, so I'll just answer here.
If you have to perform the unpacking manually, you should ask yourself - to what extent do you need it unpacked? What are you trying to achieve with ...
- 189
2
votes
Accepted
How can I extract *.c file hidden in an executable file (SkiFree)
the best you can get: https://github.com/yuv422/skifree_decomp
A source code reconstruction of the 32bit version of Skifree (v1.04)
back to C, compilable with Visual Studio 6.
so someone already did ...
- 336
1
vote
How to extract machine code from a file(especially executable) in C
its very hard to understand what you want
How to get machine code of a file(mainly executables) in C?
so you want a C program that loads an executable file (for example dos,windows,linux exucutable) ...
- 336
1
vote
How to extract machine code from a file(especially executable) in C
from binascii import *
from pefile import *
from capstone import *
if(sys.argv[1]):
pe = PE(sys.argv[1])
entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint
base = pe.OPTIONAL_HEADER....
- 16.3k
1
vote
Accepted
How to extract machine code from a file(especially executable) in C
You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind ...
- 356
1
vote
What are the way I can reverse engineer an obfuscated C++ program?
If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA....
- 21
1
vote
How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)
If you're serious about RE-ing those .EXE files, then take a look into IDA.
IDA
https://www.hex-rays.com/products/ida/
There are other applications that work some what, such as Ollydbg
- 21
1
vote
Force a firmware updater to flash any drive model
You don't need to decompile/recompile it, if you know how to read the assembler code. You just need to find the place in the code, which does the model check, and patch it to let the code execute ...
- 1,840
1
vote
How to create executable (create build) from original decompiled exe?
You cannot simply make pyinstaller gui.py. You should resolve all dependencies: or installing packages using pip, or pulling them from extracted PYZ archive folder. In the PYZ folder you can find all ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible