We changed our privacy policy. Read more.

Hot answers tagged

25

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function. All function calls in the binary are redirected to the corresponding ILT instead of pointing ...


9

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


6

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the PE: A Tour of the Win32 Portable Executable File Format). The code of the application is in the .text section, the .text file that you have actually contains ...


5

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl _IsNonwritableInCurrentImage( PBYTE pTarget ) { PBYTE pImageBase; DWORD_PTR rvaTarget; PIMAGE_SECTION_HEADER pSection; ...


3

To get your own image base in 32-bit code, you can do this: mov eax, fs:[30h] mov eax, [eax+8] which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, calculating "30h" and "8" by multiplying, etc. 64-bit code is gs:[60h] and +10h instead.


3

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. a IDB file is IDAs primary project/database format its the result of an IDA exe load + analyze run What the file is and how can i load/use it with the exe linked with it in IDA? just open it with IDA


2

You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related.


2

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and how does it access the database. To work this out you can use a tool like Process Monitor and filter on Process Name is Include and Operation is Load Image ...


2

What you want is IDA Marker. Alt+M to make a marked comment at current cursor location Ctrl+M to bring up a window showing all marked comments


2

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push opcode and the strings would be in .rdata section #include <windows.h> const char mystr1[] = "mystr1"; const char *mystr2 = "mystr2"; void main(void) { ...


2

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to the current EIP. OllyDumpEx (https://low-priority.appspot.com/ollydumpex/) is commonly used for this purpose for malware analysis. Despite its name, it is a ...


2

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For ...


2

The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article: https://isc.sans.edu/diary/How+Malware+Defends+Itself+Using+TLS+Callback+Functions/6655


2

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will be the one provided by the (C) runtime, potentially hiding gory details from you. From what I understand, Start is the entry point for an exe and it does ...


2

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the most popular combo for reading files is probably CreateFile and ReadFile api calls. If you track every operation performed on the buffer filled using ReadFile ...


1

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) and showing you the whole or parts of the image (that normaly contains machine code and data)? so there are several documented file formats that can contain ...


1

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER.ImageBase OEP = base+entry bytes = pe.get_data(entry,17) print(hexlify(bytes)) for i in (Cs(CS_ARCH_X86,CS_MODE_64).disasm(bytes,OEP)): ...


1

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind that this is not an easy task, it is much better to use a ready-made tool, we have many free and very good options and constantly updated like Ghidra, but if you ...


1

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA. You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to: ...


1

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg


1

You don't need to decompile/recompile it, if you know how to read the assembler code. You just need to find the place in the code, which does the model check, and patch it to let the code execute further. Yet to find, where the check is, you need to know how the model is read from the device. Most probably it's some IDE Disk I/O commands. Thus you need to ...


1

You cannot simply make pyinstaller gui.py. You should resolve all dependencies: or installing packages using pip, or pulling them from extracted PYZ archive folder. In the PYZ folder you can find all files, but you need to rename it and rearrange to modules.


1

You can extract some file from .exe using pyi-archive_viewer, modify them and put back. But be attention, all files in .exe are compressed using DEFLATE (zlib.compress() - you can watch this in source code of PyInstaller). So, when putting back you need compress file to the exact size, that was when you extracted it.


1

calling functions and procedures from executable file are not easy as dlls. dlls have Export Table that maps address of functions to names or ordinals. so while loading dll with LoadLibrary this table is corrected based on Image base and then by calling GetProcessAddress you can get function address with name or ordinal. if you want to load exe as library ...


1

If the program runs, it should be possible to dump the module from memory, after it was reconstructed to original state while loading it to memory.


1

Actually this has nothing to do with decompiling and little with reverse engineering. What you need to do is to change level="requireAdministrator" into level="asInvoker": <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> Using ResourceHacker you should be able to do just ...


1

A few possibilities come to mind: The application did not use WriteFile but some other API to write. one of the other APIs or one of the DLLs used by the program called WriteFile indirectly. You can try to catch the this situation by putting a breakpoint on the final API in kernel32 (kernel32_WriteFile). As mentined by Amirag, the program could be calling ...


1

The best way to find this URL is looking into EXE with disassembler like IDA(you can use free version for this). It will disassemble EXE and then you can search for this string. If URL really isn't in the file, then you must locate function that is sending informations to the website. The best way is look for functions that are using Windows' network API. ...


1

Look into ReadProcessMemory WinAPI, alternatively CheatEngine is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.). You could also search on Github for some other memory "hacking" projects in a language that you are familiar with. Cheat engine can find the exact memory address in the memory of the ...


Only top voted, non community-wiki answers of a minimum length are eligible