12 votes
Accepted

Is it possible for a .exe PE file to do something without any imports at all?

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four ...
NirIzr's user avatar
  • 11.8k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
Megabeets's user avatar
  • 8,959
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
NirIzr's user avatar
  • 11.8k
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,060
7 votes

Is it possible for a .exe PE file to do something without any imports at all?

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
blabb's user avatar
  • 16.3k
7 votes

Trying To Read Code From Call of Duty

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
svick's user avatar
  • 410
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
Paweł Łukasik's user avatar
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
Igor Skochinsky's user avatar
  • 36.5k
6 votes
Accepted

How can I modify binary image resource data?

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN: RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary ...
Megabeets's user avatar
  • 8,959
5 votes
Accepted

How is .rdata used within the executable

The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (...
DarthGizka's user avatar
  • 2,010
5 votes
Accepted

Is it possible to extract or otherwise edit the source code of an .exe file?

Principally: Yes. But: it's not practically. You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need ...
falx's user avatar
  • 66
5 votes

Check if exe is 64-bit

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...
dsasmblr's user avatar
  • 2,234
5 votes

Is it possible for a .exe PE file to do something without any imports at all?

Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov: Unfortunately the 97 byte PE file does not work on Windows 2000. This is ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
Megabeets's user avatar
  • 8,959
5 votes
Accepted

Gaps between sections

Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by ...
shebaw's user avatar
  • 685
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
Igor Skochinsky's user avatar
  • 36.5k
4 votes

How does disassembler really work?

You have basically two options: Linear Sweep Read the first N-bytes until you get a correct opcode (e.g., 05 14 00 00 00 decompiles to add eax,0x14). Disassemble the next opcode. You will read some ...
user3422070's user avatar
4 votes
Accepted

How to analyze deeply every single step of a windows executable/installer

It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity: If you need to examine the details of the network traffic, ...
Jason Geffner's user avatar
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
knx's user avatar
  • 1,257
4 votes
Accepted

Disassembling an MS-DOS EXE

The entry point is calculated like this: ((header_paragraphs + cs) << 4) + ip I wrote a MZ exe disassembler time ago, take a look.
Nico01's user avatar
  • 91
4 votes
Accepted

Exports that redirects to other library

This is called export forwarding and you can explore it here with nice explanation: The PE file format The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of exported items. It ...
PhoeniX's user avatar
  • 3,022
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
EIP Passenger's user avatar
4 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

To get your own image base in 32-bit code, you can do this: mov eax, fs:[30h] mov eax, [eax+8] which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
peter ferrie's user avatar
  • 4,699
4 votes
Accepted

How to get offset of specific function in exe?

x64dbg can load the pdb and list all the function names if you have pdb for your executable view->modules->download symbols for this module also x64dbg can use the source file (ctrl+shift+s) ...
blabb's user avatar
  • 16.3k
3 votes

Ollydbg: Function name list like in IDA

1 Ctrl +n or right click view names / view intermodular calls 2 ctrl+ or ctrl - to jump back and forth. Or open shortcut editor in ollydbg v2 and set your favorite shortcut for navigation
blabb's user avatar
  • 16.3k
3 votes
Accepted

Reverse Engineering Chinese laser engraver

VB Decompiler is for decompiling native programs and P-code programs. But as @ebux said, your target appears to be written in .NET, so you'd need to use something like ILSpy or .NET Reflector. ...
Jason Geffner's user avatar
3 votes

Is it possible to extract or otherwise edit the source code of an .exe file?

The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the ....
peter ferrie's user avatar
  • 4,699
3 votes

How to change the strings in rdata section of a executable file?

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
blabb's user avatar
  • 16.3k

Only top scored, non community-wiki answers of a minimum length are eligible