Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
39

(reposting my SO answer to a similar question) In many cases it is possible to identify the compiler used to compile the code, and from that, the original language. Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...


38

There are several broad ways in which you could do this. Dynamic instrumentation Tools such as PIN, Valgrind, or DynamoRIO allow you to dynamically change the behavior of a program. For instance, you can add calls to new functions at particular addresses, intercept library calls and change them, and much more. The downside is that dynamic instrumentation ...


22

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


17

It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as the LeCroy Voyager M3i. If you have a decent size budget and you only need USB 2.0, I would go for the Ellisys USB Explorer 200. If you want to replay and change ...


16

Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the program comes in the form of one main executable plus several libraries. You can hook into any call that the program makes to shared libraries by linking your ...


16

.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework. C++ can be identified by looking at the assembly - it uses this call convention. PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...


12

I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this : Once you found it, remove all the content ...


11

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four types of reasonable, useable executable file types that may not have any imports: An executable that does not require any OS APIs. This is somewhat similar to ...


9

In addition to Peter Andersson's list of tools, you may also want to consider USBTrace and Bus Hound.


9

If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 6/26/13: PE Explorer ...


9

There are several tools that I have used: PEiD (PE iDentifier) I've also followed this guide and converted PEiD signatures to YARA signatures and simply used YARA TRiD can also provide another way to identify the compiler used It's also worth mentioning that if you submit a file to Virus Total, they will run TRiD against your binary. These tools are not ...


9

Actually I would suggest that you view the executeable with a hex viewer/editor. That way you can see straight away if the compiler embedded any strings as hints. You should also consider that some languages use C as an intermediate language. An example of that would be f2c a Fortran 77 to C compliler. It appears that f2c also links a support library so you ...


8

either: patch a debug break (CC int3) or an infinite loop (EB FE jmp $) at the start of the TLS try to set a breakpoint as early as possible (like OllyDbg's Options/Events/Make first pause at/System Breakpoint), then set a breakpoint at the TLS' starts use a specific plugin, such as OllyAdvanced for OllyDbg. Note that the conditions for TLS execution are ...


8

According to the developer of Resource Hacker, this product is discontinued (and hasn't been updated since Sep 2011): I have been overwhelmed by the interest in Resource HackerTM, the emails of thanks, encouragement and suggestions. It's been downloaded many millions of times. However, I've moved on to other things and have no plans to continue its ...


8

Marco Pontello's TrID software can usually identify what was used to compile a file.


8

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[NCHAR]; char codepoint(char c); int main(void) { char *secret; setkey(5); secret=strdup("Hello World"); printf("%s\n", encrypt(secret)); } void ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


7

If you aren't afraid to get your hands dirty, on Windows you could always write a filter driver on top of or below the device object for the dongle. The IoAttachDevice() function and the three other functions starting with that name are your friend. The advantage of that is to have a complete in-software solution for the problem without the expenses involved ...


7

Tho maybe not directly what you are looking for I'd just like to add one item to Peter Andersson's thorough answer. Travis Goodspeed's facedancer (some more recent info ). Its design is also open source. Facedancer Board, a tool for implementing USB devices in host-side Python using the GoodFET framework. Access to the USB chip is extremely low-level, so ...


7

(Slightly outdated, but as that wasn't mentioned previously in this thread) Long ago, I spend months extending a software with only the binary. I used IDA for analysis and SoftICE for live debugging. Decompiling is not required if you can understand the target at opcode/bytecode level. Then, because it was an x86 PE binary, I used Tasm and Iczelion's Code ...


7

I want to add some functionality to an existing binary file. So in general these four bigger Questions apply to modifying an Executeable: The first basic Question posed: Is the Program wary of Code Modifications (Self-Checking, Anti-Debug-Tricks, Copy protection, ...)? If so: Is it even possible to remove/circumevent these protections (e.g. unpacking, ...


7

Over the 30+ embedded device firmwares I've seen in the past I have rarely seen them using anything proprietary. Often it's just gzip/LZMA or a similar compression they're using (albeit sometimes with modified or stripped headers). Thus as a first step I would try something like binwalk to search for known compression algorithms. If that doesn't help try ...


7

Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++. Here are some things specific to Delphi that I found important to know when reversing such applications. Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically compiled in the application binary. This results in ...


7

The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable. See this question for more information. Also see this introduction to the dotnet file format for an overview.


7

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. 00000020 26 DA 55 A0 26 5A 56 A0 08 DA 56 A0 47 5A 57 A0 &.U.&ZV...V.GZW. 00000030 35 DA 57 A0 32 5A 58 A0 3B DA 58 A0 5.W.2ZX.;.X. As you ...


6

You do not need to decompile the binary. If you understand what changes you want to make, and those changes can be made by only modifying the binary file or its dependencies, then you can just make those modifications on disk or in memory. You have a few choices on how to effect the modification itself. You could use LD_PRELOAD to have the linker load a ...


6

Doing that on Windows Although this question focuses on Linux, where personally I would go with the easy LD_PRELOAD method as outlined in other answers, Windows knows a similar mechanism that in fact has been abused in the more recent past (also see alternative approaches below). I used that method to "crack" one dongle system. Enter ... DLL placement (...


6

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit


6

There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation. The best approach would be to write a small program or script in your favourite Swiss Army Knife language for validating the integrity of your output image, with a focus on ...


6

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will have to extend or adjust the PHT manually. You can either do it manually with a hex editor or try using a library such as libelf (it gives you necessary ...


Only top voted, non community-wiki answers of a minimum length are eligible