(reposting my SO answer to a similar question)
In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.
Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...
There are several broad ways in which you could do this.
Tools such as PIN, Valgrind, or DynamoRIO allow you to dynamically change the behavior of a program. For instance, you can add calls to new functions at particular addresses, intercept library calls and change them, and much more.
The downside is that dynamic instrumentation ...
Executable type is indicated by PE header, download documentation.
The first word (two bytes) of PE header indicates target machine, here is a list of possible values:
0x0000 - The contents of this field are assumed to be applicable to any machine type
0x01d3 - Matsushita AM33
0x8664 - x64
0x01c0 - ARM little endian
0x01c4 - ARMv7 (or higher) Thumb mode ...
Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the program comes in the form of one main executable plus several libraries.
You can hook into any call that the program makes to shared libraries by linking your ...
It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as the LeCroy Voyager M3i. If you have a decent size budget and you only need USB 2.0, I would go for the Ellisys USB Explorer 200. If you want to replay and change ...
.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework.
C++ can be identified by
looking at the assembly - it uses this call convention.
PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...
I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this :
Once you found it, remove all the content ...
Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level.
I can think of four types of reasonable, useable executable file types that may not have any imports:
An executable that does not require any OS APIs.
This is somewhat similar to ...
If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors
In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 6/26/13:
There are several tools that I have used:
PEiD (PE iDentifier)
I've also followed this guide and converted PEiD signatures to YARA signatures and simply used YARA
TRiD can also provide another way to identify the compiler used
It's also worth mentioning that if you submit a file to Virus Total, they will run TRiD against your binary.
These tools are not ...
Actually I would suggest that you view the executeable with a hex viewer/editor. That way you can see straight away if the compiler embedded any strings as hints. You should also consider that some languages use C as an intermediate language. An example of that would be f2c a Fortran 77 to C compliler. It appears that f2c also links a support library so you ...
patch a debug break (CC int3) or an infinite loop (EB FE jmp $) at the start of the TLS
try to set a breakpoint as early as possible (like OllyDbg's Options/Events/Make first pause at/System Breakpoint), then set a breakpoint at the TLS' starts
use a specific plugin, such as OllyAdvanced for OllyDbg.
Note that the conditions for TLS execution are ...
According to the developer of Resource Hacker, this product is discontinued (and hasn't been updated since Sep 2011):
I have been overwhelmed by the interest in Resource HackerTM, the
emails of thanks, encouragement and suggestions. It's been downloaded
many millions of times. However, I've moved on to other things and
have no plans to continue its ...
Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++. Here are some things specific to Delphi that I found important to know when reversing such applications.
Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically compiled in the application binary. This results in ...
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions:
This works because call will push the next address (where pop eax ...
If you aren't afraid to get your hands dirty, on Windows you could always write a filter driver on top of or below the device object for the dongle. The IoAttachDevice() function and the three other functions starting with that name are your friend. The advantage of that is to have a complete in-software solution for the problem without the expenses involved ...
Tho maybe not directly what you are looking for I'd just like to add one item to Peter Andersson's thorough answer. Travis Goodspeed's facedancer (some more recent info ). Its design is also open source.
Facedancer Board, a tool for implementing USB devices in host-side Python using the GoodFET framework. Access to the USB chip is extremely low-level, so ...
(Slightly outdated, but as that wasn't mentioned previously in this thread)
Long ago, I spend months extending a software with only the binary.
I used IDA for analysis and SoftICE for live debugging. Decompiling is not required if you can understand the target at opcode/bytecode level.
Then, because it was an x86 PE binary, I used Tasm and Iczelion's Code ...
I want to add some functionality to an existing binary file.
So in general these four bigger Questions apply to modifying an Executeable:
The first basic Question posed:
Is the Program wary of Code Modifications (Self-Checking, Anti-Debug-Tricks, Copy protection, ...)?
Is it even possible to remove/circumevent these protections (e.g. unpacking, ...
Over the 30+ embedded device firmwares I've seen in the past I have rarely seen them using anything proprietary. Often it's just gzip/LZMA or a similar compression they're using (albeit sometimes with modified or stripped headers).
Thus as a first step I would try something like binwalk to search for known compression algorithms. If that doesn't help try ...
The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable.
See this question for more information. Also see this introduction to the dotnet file format for an overview.
There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation.
The best approach would be to write a small program or script in your favourite Swiss Army Knife language for validating the integrity of your output image, with a focus on ...
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...
The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.
Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only ...
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...