25 votes
Accepted

Check if exe is 64-bit

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this ...
user avatar
  • 789
11 votes
Accepted

Is it possible for a .exe PE file to do something without any imports at all?

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four ...
user avatar
  • 11.4k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
user avatar
  • 8,629
9 votes

How to extract functions from one executable to include/link in another

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[...
user avatar
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
user avatar
  • 11.4k
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
user avatar
  • 5,850
7 votes
Accepted

How does the OS distinguish between executable types

The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable. See this question for ...
user avatar
  • 1,561
7 votes

Is not valid win32 application. Why?

There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation. The best ...
user avatar
  • 1,960
7 votes

Check if exe is 64-bit

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit
user avatar
  • 221
7 votes

Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt

This is a hex dump of your sample file: 00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS. 00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU. ...
user avatar
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
user avatar
6 votes

Trying To Read Code From Call of Duty

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
user avatar
  • 390
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
user avatar
  • 34.7k
6 votes

Is it possible for a .exe PE file to do something without any imports at all?

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
user avatar
  • 14.9k
6 votes
Accepted

How can I modify binary image resource data?

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN: RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary ...
user avatar
  • 8,629
5 votes
Accepted

What is an indicator that a PE section definitely contains stuff of a specific type?

I can only definitely recognize code sections by looking if the IMAGE_SCN_MEM_EXECUTE flag is set, as other sections should not have this flag set. The presence of this flag doesn't "definitely" ...
user avatar
5 votes

Check if exe is 64-bit

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...
user avatar
  • 2,154
5 votes
Accepted

Is it possible to extract or otherwise edit the source code of an .exe file?

Principally: Yes. But: it's not practically. You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need ...
user avatar
  • 66
5 votes
Accepted

How is .rdata used within the executable

The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (...
user avatar
  • 1,960
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
user avatar
  • 8,629
5 votes
Accepted

Gaps between sections

Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by ...
user avatar
  • 655
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
user avatar
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
user avatar
  • 34.7k
4 votes
Accepted

How to strip more than symbols?

It is possible that you are using RTTI. Try compiling your code with option -fno-rtti. Update: It is really RTTI. I don't know how exactly it works, but I succeeded to remove those strings as ...
user avatar
  • 7,720
4 votes

How to find compressed or encrypted parts in a packed executable?

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can ...
user avatar
  • 1,814
4 votes

Can mprotect set the stack itself as executable?

Yes, mprotect can be used to make the stack executable. See, for example: https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c http://rethinkdb.com/blog/handling-...
user avatar
4 votes

How does disassembler really work?

You have basically two options: Linear Sweep Read the first N-bytes until you get a correct opcode (e.g., 05 14 00 00 00 decompiles to add eax,0x14). Disassemble the next opcode. You will read some ...
user avatar
4 votes
Accepted

How to analyze deeply every single step of a windows executable/installer

It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity: If you need to examine the details of the network traffic, ...
user avatar
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
user avatar
  • 1,227
4 votes
Accepted

Disassembling an MS-DOS EXE

The entry point is calculated like this: ((header_paragraphs + cs) << 4) + ip I wrote a MZ exe disassembler time ago, take a look.
user avatar
  • 91

Only top scored, non community-wiki answers of a minimum length are eligible