Skip to main content
12 votes
Accepted

Is it possible for a .exe PE file to do something without any imports at all?

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four ...
NirIzr's user avatar
  • 11.8k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
Megabeets's user avatar
  • 8,999
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
NirIzr's user avatar
  • 11.8k
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,090
7 votes

Trying To Read Code From Call of Duty

Windows applications (.exe) generally use file format called "Portable Executable" (PE). The "files" that you extracted are actually sections of that PE file (see Common Sections in Peering Inside the ...
svick's user avatar
  • 410
7 votes

Is it possible for a .exe PE file to do something without any imports at all?

void main (void) { __asm { retn } } compiled and linked using cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:...
blabb's user avatar
  • 16.4k
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
Paweł Łukasik's user avatar
6 votes
Accepted

How can I modify binary image resource data?

Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN: RCDATA defines a raw data resource for an application. Raw data resources permit the inclusion of binary ...
Megabeets's user avatar
  • 8,999
6 votes
Accepted

How to SUCCESSFULLY add a code section to an executable file in Linux?

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

How is .rdata used within the executable

The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (...
DarthGizka's user avatar
  • 2,010
5 votes

Check if exe is 64-bit

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...
dsasmblr's user avatar
  • 2,234
5 votes

Is it possible for a .exe PE file to do something without any imports at all?

Yes, it is possible but may depend on the OS you're trying to run it on. From the TinyPE page by Alexander Sotirov: Unfortunately the 97 byte PE file does not work on Windows 2000. This is ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
Megabeets's user avatar
  • 8,999
5 votes
Accepted

Gaps between sections

Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by ...
shebaw's user avatar
  • 685
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
5 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

If you use Visual C++, you can use the special symbol __ImageBase which points to image base of the current module. For example, here's code from VS2010 CRT source (pesect.c): BOOL __cdecl ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

Exports that redirects to other library

This is called export forwarding and you can explore it here with nice explanation: The PE file format The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of exported items. It ...
PhoeniX's user avatar
  • 3,062
4 votes
Accepted

Order of architecture headers in fat (universal) executables

There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of fat_arch sections? The kernel simply loads ...
knx's user avatar
  • 1,257
4 votes
Accepted

Disassembling an MS-DOS EXE

The entry point is calculated like this: ((header_paragraphs + cs) << 4) + ip I wrote a MZ exe disassembler time ago, take a look.
Nico01's user avatar
  • 91
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
EIP Passenger's user avatar
4 votes

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

To get your own image base in 32-bit code, you can do this: mov eax, fs:[30h] mov eax, [eax+8] which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, ...
peter ferrie's user avatar
  • 4,709
4 votes
Accepted

How to get offset of specific function in exe?

x64dbg can load the pdb and list all the function names if you have pdb for your executable view->modules->download symbols for this module also x64dbg can use the source file (ctrl+shift+s) ...
blabb's user avatar
  • 16.4k
3 votes

Ollydbg: Function name list like in IDA

1 Ctrl +n or right click view names / view intermodular calls 2 ctrl+ or ctrl - to jump back and forth. Or open shortcut editor in ollydbg v2 and set your favorite shortcut for navigation
blabb's user avatar
  • 16.4k
3 votes

How to change the strings in rdata section of a executable file?

it is a tough and tedious task and completely error prone assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push ...
blabb's user avatar
  • 16.4k
3 votes

How to see ReadFile results with ProcMon

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Why doesn't this retn instruction return from the function?

My answers: Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just ...
perror's user avatar
  • 19.1k
3 votes
Accepted

Are the names of COFF Data Directories fixed?

In short: Yes Correct You have to have a specification to know. The data directories are a fixed sparse array, and the meaning of each slot is defined by the specification, so (for example) the ...
josh poley's user avatar
3 votes
Accepted

change PE file icon without re-signing the file all over again

This is normally not possible. The icon is part of the resource section (.rsrc) which is covered by the signature so any modification will invalidate it and the binary needs to be re-signed. There ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

How can I extract *.c file hidden in an executable file (SkiFree)

It's not common for executables to include their own source code, so in general, the answer to your question is "that's not possible". That string likely appears in the binary due to some ...
Rolf Rolles's user avatar
  • 9,198

Only top scored, non community-wiki answers of a minimum length are eligible