11
votes
Accepted
Is it possible for a .exe PE file to do something without any imports at all?
Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level.
I can think of four ...
- 11.7k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 8,849
8
votes
Accepted
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
- 11.7k
8
votes
Best way to protect source code of .exe program running on Python?
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
...
- 5,990
7
votes
Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &/or gone bankrupt
This is a hex dump of your sample file:
00000000 1F DA 51 A0 19 5A 52 A0 19 DA 52 A0 28 5A 53 A0 ..Q..ZR...R.(ZS.
00000010 28 DA 53 A0 24 5A 54 A0 1A DA 54 A0 2A 5A 55 A0 (.S.$ZT...T.*ZU.
...
- 12.8k
7
votes
Trying To Read Code From Call of Duty
Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
- 400
7
votes
Why doesn't this retn instruction return from the function?
The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
- 4,692
6
votes
Accepted
How to SUCCESSFULLY add a code section to an executable file in Linux?
libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
- 35.8k
6
votes
Is it possible for a .exe PE file to do something without any imports at all?
void main (void)
{
__asm
{
retn
}
}
compiled and linked using
cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
- 15.8k
6
votes
Accepted
How can I modify binary image resource data?
Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:
RCDATA defines a raw data resource for an application. Raw data resources
permit the inclusion of binary ...
- 8,849
5
votes
Accepted
Is it possible to extract or otherwise edit the source code of an .exe file?
Principally: Yes.
But: it's not practically.
You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need ...
- 66
5
votes
Check if exe is 64-bit
Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary:
Right-click on the application.
Click Properties.
Click the Compatibility tab.
In the ...
- 2,204
5
votes
Accepted
How is .rdata used within the executable
The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (...
- 1,990
5
votes
Accepted
Change sending IP of only certain executable
Following OP's other questions, assuming Windows OS
This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs:
Proxifier
Proxifier allows ...
- 8,849
5
votes
Accepted
Gaps between sections
Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by ...
- 685
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
5
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c):
BOOL __cdecl ...
- 35.8k
4
votes
Can mprotect set the stack itself as executable?
Yes, mprotect can be used to make the stack executable.
See, for example:
https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c
http://rethinkdb.com/blog/handling-...
- 20.6k
4
votes
How to find compressed or encrypted parts in a packed executable?
A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can ...
- 1,964
4
votes
How does disassembler really work?
You have basically two options:
Linear Sweep
Read the first N-bytes until you get a correct opcode (e.g., 05 14 00 00 00 decompiles to add eax,0x14). Disassemble the next opcode. You will read some ...
- 173
4
votes
Accepted
How to analyze deeply every single step of a windows executable/installer
It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity:
If you need to examine the details of the network traffic, ...
- 20.6k
4
votes
Accepted
Order of architecture headers in fat (universal) executables
There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections?
The kernel simply loads ...
- 1,257
4
votes
Accepted
Disassembling an MS-DOS EXE
The entry point is calculated like this:
((header_paragraphs + cs) << 4) + ip
I wrote a MZ exe disassembler time ago, take a look.
- 91
4
votes
Is it possible for a .exe PE file to do something without any imports at all?
Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov:
Unfortunately the 97 byte PE file does not work on Windows 2000. This
is ...
- 35.8k
4
votes
Accepted
Exports that redirects to other library
This is called export forwarding and you can explore it here with nice explanation:
The PE file format
The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of
exported items. It ...
- 3,002
4
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
4
votes
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
To get your own image base in 32-bit code, you can do this:
mov eax, fs:[30h]
mov eax, [eax+8]
which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
- 4,691
4
votes
Accepted
How to get offset of specific function in exe?
x64dbg can load the pdb and list all the function names if you have pdb for your executable
view->modules->download symbols for this module
also x64dbg can use the source file (ctrl+shift+s)
...
- 15.8k
3
votes
Is it possible to extract or otherwise edit the source code of an .exe file?
The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the ....
- 4,691
3
votes
Accepted
Is it possible to decompile the password protected rar file?
Is it possible to decompile the password protected rar file?
Decompilation is for code. RAR files are data. So no, there's nothing in a RAR file to decompile.
But, if we convert a password-...
- 20.6k
Only top scored, non community-wiki answers of a minimum length are eligible