Skip to main content
19 votes

lzma: File format not recognized [Details enclosed]

It's a false positive. There is no LZMA-compressed data in the binary. Running binwalk without any arguments other than the firmware binary file name is equivalent to running it with the -B or --...
julian's user avatar
  • 7,158
12 votes
Accepted

xor eax, eax in x64

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
Igor Skochinsky's user avatar
  • 36.8k
8 votes
Accepted

Changing strings in Hopper Disassembler

You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel. Then modify whatever you want You'll need to write a new executable back (⇧⌘E) if you want to save ...
cimarron's user avatar
  • 1,341
6 votes

Change binary without damage

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
dsasmblr's user avatar
  • 2,234
6 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled ...
sudhackar's user avatar
  • 2,709
5 votes
Accepted

Change instruction test eax, eax to text eax, 1

The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1. The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example ...
bart1e's user avatar
  • 3,409
5 votes

Inverse And operation

The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed: 0 & 1 = 0 0 & 0 = 0 Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible....
Megabeets's user avatar
  • 8,999
4 votes

how to fix this rsrc data in ida pro?

The Win32 resource data is usually not referenced directly from the code; resource APIs such as FindResource, LoadResource and LockResource are used to access that data. You can use a resource editor ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

How do I change a string correctly in IDA Pro?

To understand what's happening, you need to learn about Position Independent Code (PIC). In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets ...
Guntram Blohm's user avatar
4 votes
Accepted

Not able to find Hard coded strings in the mac executable file

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can ...
camp0's user avatar
  • 254
4 votes

In reverse engineering, what does it mean to "patch a file"?

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of ...
bart1e's user avatar
  • 3,409
4 votes

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

When does the PE loader fill in the IAT? The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
plowsec's user avatar
  • 143
3 votes

IDA PRO - compare running process

What you are asking for is called "Differential Debugging". Take a look to this tutorial to see how to do so with IDA without requiring any kind of plugins, just built-in functionality.
joxeankoret's user avatar
  • 4,488
3 votes
Accepted

Has there been any success in using deep learning for reverse engineering?

I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the ...
dingo_kinznerhook's user avatar
3 votes
Accepted

Find flag from GO binary challenge

Since you have already spent a lot of time on it, I will just show you how to solve it step by step. I recommend you to repeat steps I'm describing, since the best way to learn is to practice. Tool I ...
bart1e's user avatar
  • 3,409
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
Antimony's user avatar
  • 2,012
3 votes
Accepted

Assembly and C++

The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

How can I patch this file?

Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding. That said, in IDA: ...
Guntram Blohm's user avatar
3 votes
Accepted

How can I retrieve the encryption key in this code?

The encryption key is stored in the variable f4800b. It comes out to the following byte array. 43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60 The cipher algorithm used is ...
0xec's user avatar
  • 6,090
2 votes

Using HEX editor and making 4 chars from 3 chars

As Far As i Know there isn't another way assume you have a program like this the hex for this function will look like this 0:000> db main l21 00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

Inverse And operation

While there's no way to know with 100% certainty what was the original value before the AND operation, you can find some possible values producing the same result, and sometimes that's enough. ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Patching a class file inside Jar using bytecode

Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
tr4nc3's user avatar
  • 121
2 votes
Accepted

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

the Apis like Sleep are documented a header file is provided in the sdk a library to link against is provided by sdk (windows.h ,kernel32.lib) api s like Zwxxx are internal or advanced user apis ...
blabb's user avatar
  • 16.4k
2 votes

Android app crashes even while not edited, how can I solve it?

W System : ClassLoader referenced unknown path: /data/app/com.ibsbankmobile-1/lib/arm64 E AndroidRuntime: Process: com.ibsbankmobile, PID: 3053 The warning here shows that you have a missing path: /...
Yotamz's user avatar
  • 1,227
2 votes

Force debug Administrator Malware

Some ideas: Try using Image File Execution Options registry key to automatically run the debugger when the process starts. Patch an infinite loop (EB FE) at the entry point, start the binary, then ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Decrypt application protocol packet

The encryption routine is not likely to be in your call stack because it is not actually going to call the send function directly. I would suggest you set a watch point inside the buffer to catch ...
Artelius's user avatar
  • 241
2 votes

How can I analyze this code?

That is not heavily obfuscated. The code is just using short names. I would use Search & Replace in your favorite text editor to give them more memorable names.
Johann Aydinbas's user avatar
2 votes

Static Binary in Windows

Unlike Linux, syscall numbers can and do change between Windows versions, so any program using raw syscalls would not run properly on a different OS release. The only officially supported API is ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

HEX code to call DLL function

The proper way to do this is to rename your A.DLL to another name (let's call it Z.DLL), and then create a new A.DLL which is your code. For each export in the Z.DLL, you create an export in your A....
peter ferrie's user avatar
  • 4,709

Only top scored, non community-wiki answers of a minimum length are eligible