8 votes
Accepted

Inject code into exe

Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote: Another way to copy some code to another process's address space and then ...
user avatar
  • 2,144
4 votes

How To Identify Which Process Is Being Written To With WriteProcessMemory?

It is also easy using x64dbg. When you break on the WriteProcessMemory the handle will be at [esp+0x4] in the memory. After you write down the handle (in this case 0xDC) you may go to the Handles ...
user avatar
  • 686
4 votes
Accepted

How to analyze dumped process?

Disclaimer: I'm going to expose my workflow when I see similar things. I'm not telling you that this is the best one or the faster, and I'm sure you have a lot of other way to deal with this. But this ...
user avatar
  • 619
3 votes

How To Identify Which Process Is Being Written To With WriteProcessMemory?

which debugger are you using ? most debuggers will decipher the handle on the spot that is you can find out the handle info when you have broken on the WriteProcessMemory() Call itself here is how ...
user avatar
  • 14.8k
3 votes
Accepted

ELF binary injection

When executing ELF files, the OS loader does not care about sections but only segments (aka program headers). You need to ensure your code belongs to an executable segment. As can be seen, section ....
user avatar
  • 34.6k
3 votes
Accepted

Using cheat engine to activate a modified version of a lua script

Unfortunately, as a beginner, there's a LOT for you to learn where this topic is concerned. It's not that it's particularly outside of your grasp to understand, but rather that it's going to take ...
user avatar
  • 2,144
3 votes
Accepted

Why is the process crashing after executing my injected payload?

Here's the rest of the function where the crash happens: _KiUserApcDispatcher@16 proc near lea eax, [esp+2DCh] mov ecx, large fs:0 mov edx, offset _KiUserApcExceptionHandler@16 ; ...
user avatar
  • 34.6k
3 votes

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() ...
user avatar
  • 4,511
3 votes
Accepted

How to debug malware that injects itself into another process?

Most of the times when a malware does something like that it's simply to make debugging it harder. Therefore, you can easily breakpoint on the injection procedure and redirect it to another process. ...
user avatar
  • 11.3k
3 votes
Accepted

Hooking IAT in remote process with Python?

I cross-posted this to another community that I'm a part of and ended up getting my answer (I should have done this sooner..): It was likely that my code was getting garbage collected, hence the lock ...
user avatar
2 votes

Hacking Lua - Introduce new functions into built Lua

One way of doing this : Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your ...
user avatar
  • 578
2 votes
Accepted

How to manipulate game which loads many dll's

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs. First, you'll need to get the address/handle (...
user avatar
  • 11.3k
2 votes
Accepted

Save injected code

So your definition of a "snapshot" is somewhat vague. Hopefully my answer matches your idea: Did you already take a look at the OllyDumpEx Plugin? This plugin is process memory dumper for OllyDbg ...
user avatar
  • 1,227
2 votes
Accepted

Inject into game developer's console

In Call of Duty games you can search for the string "xpartygo" and xref that with IDA. That way you'll find Cmd_ExecuteSingleCommand.
user avatar
  • 156
2 votes

Adding Features to a Released PC Game

Yes, you need to look into reverse engineering discipline. There's a lot of books written on this topic, for example: Book 1 Book 2 Book 3 By reading those books, you'll get acknowledged with need ...
user avatar
  • 403
2 votes
Accepted

Modifying address found through IDA

how I'd go from a static address in IDA, to an actual address ... in another C++ program When executable file is loaded in IDA, it is loaded with the preferred image base taken from executable's ...
user avatar
2 votes

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Many programs, especially malware, start a suspended child process (CreateProcess variants), overwrite its code with their own (WriteProcessMemory with or without VirtualAllocEx) and resume the main ...
user avatar
  • 822
2 votes
Accepted

How to split bytes into instructions in binary ELF file for x86

The x86/x64 instruction set is variable length and there are no obvious instruction boundaries. You can make use of a length disassembler to figure out how long each instruction is. There are a bunch ...
user avatar
  • 34.6k
2 votes

How to inject some code to ARM .so files permanently?

As I understand, you want to replace the function with code such that it returns a pointer to the ASCII string "kowewqzb". Since the function in question is quite long you have sufficient space to ...
user avatar
  • 5,850
2 votes

Why a single "nop" crashed the game?

CreateRemoteThread takes 7 arguments and the 4th of them is called lpStartAddress. Now, from MSDN docs: lpStartAddress A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to ...
user avatar
  • 3,179
1 vote

Import Address Table in Process Hollowing

Obviously you should resolve the address in IAT. This is a manually mapped dll code, you can take a look. #include <stdio.h> #include <Windows.h> #include <intrin.h> typedef HMODULE(...
user avatar
  • 117
1 vote
Accepted

Call libc functions from the payload statically injected into ELF binary

For any external functions used (e.g. libc functions), there will exist a stub in the binary's PLT for said function. When the program calls the function, it jumps to the PLT stub, which correctly ...
user avatar
1 vote

Converting a data address offset to the equivalent struct in a C++ module

So silly me, the function n_GetLocalPlayer() needed to be dereferenced and then the result from the offset dereferenced again. It works now. Here's the format: playerData* lpData = reinterpret_cast<...
user avatar
  • 21
1 vote

modern instrumentation for reversing and researching

Some may favor miasm over other frameworks (see for instance the Advanced Binary Deobfuscation material). Examples: Analyzing Shellcodes with Miasm for Fun and Profit ZeusVM analysis The Qiling ...
user avatar
  • 6,829
1 vote

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

Great tool to achieve this in Windows is Application Verifier. The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made ...
user avatar
1 vote

Executable code in the same location differs in memory and on disk

I started from scratch, used OllyDbg to find the opcodes as they are in memory and then wrote my heuristics for finding certain opcodes of interest also operate on the image in memory. There were some ...
user avatar
  • 21
1 vote

learning detour and code injection

Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
user avatar
  • 51
1 vote

learning detour and code injection

Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
user avatar
1 vote

Unable to call function with CreateRemoteThread

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first ...
user avatar
1 vote

Detect a process for being injected with a dll

You can recursively follow dependencies to figure out which DLLs were loaded directly by the Windows loader. You may create an imported modules list. Fill imported module list with every module you ...
user avatar
  • 11.3k

Only top scored, non community-wiki answers of a minimum length are eligible