19 votes

lzma: File format not recognized [Details enclosed]

It's a false positive. There is no LZMA-compressed data in the binary. Running binwalk without any arguments other than the firmware binary file name is equivalent to running it with the -B or --...
user avatar
  • 6,859
11 votes
Accepted

xor eax, eax in x64

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
user avatar
  • 34.7k
8 votes

how can file size and PE size cant be equal?

"File Size" is the size of the file on disk, according to the file system. "PE Size" is the value of the SizeOfImage field in the IMAGE_OPTIONAL_HEADER structure in the PE file. Its value is ...
user avatar
8 votes
Accepted

Changing strings in Hopper Disassembler

You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel. Then modify whatever you want You'll need to write a new executable back (⇧⌘E) if you want to save ...
user avatar
  • 1,321
6 votes

How to reverse a dll and call its functions?

You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
user avatar
5 votes

How to view strings in an executable?

If you are running Linux, you can run the strings command to view the hardcoded strings within the binary you are analyzing. Example: $ strings my_executable The strings program is also available ...
user avatar
  • 420
5 votes
Accepted

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, ...
user avatar
5 votes

Inverse And operation

The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed: 0 & 1 = 0 0 & 0 = 0 Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible....
user avatar
  • 8,629
5 votes

Change binary without damage

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
user avatar
  • 2,154
5 votes
Accepted

Change instruction test eax, eax to text eax, 1

The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1. The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example ...
user avatar
  • 3,189
5 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled ...
user avatar
  • 2,389
4 votes
Accepted

How to add new button to an executable?

It may be generated dynamically, loaded from a file, be there, but obfuscated or encrypted, in the original .exe, or something else. The easiest way to get the url is probably using Fiddler, as you're ...
user avatar
4 votes
Accepted

Decompile erlang .beam files compiled without debug_info

You can get low-level bytecode source of .beam file with beam_disasm:file(module_name) It's not easy to read it and takes time to figure it out. But it's much verbose and easier to comprehend than ...
user avatar
  • 156
4 votes
Accepted

is ther a way an app can display a message without the use of messagebox API?

First you need to determine if it is windows message box or not. What kind of message is in the message box (custom/standard win32/compilation of system strings)? Also an screen-shot would be nice if ...
user avatar
  • 1,374
4 votes

is ther a way an app can display a message without the use of messagebox API?

The MessageBox API just creates a windows dialog and spins in a message loop until it is closed. A program can do this themselves without using MessageBox, you can look for calls to either ...
user avatar
4 votes
Accepted

How to view strings in an executable?

These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as ...
user avatar
  • 11.4k
4 votes
Accepted

How do I change a string correctly in IDA Pro?

To understand what's happening, you need to learn about Position Independent Code (PIC). In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets ...
user avatar
4 votes
Accepted

Not able to find Hard coded strings in the mac executable file

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can ...
user avatar
  • 244
3 votes

How to change text on the button?

Open the executable file with a hex editor, search for the string "Continue", and overwrite those bytes with the string "Carry on".
user avatar
3 votes

debug a .dll compressed with pe compact

There exist unpackers for PECompact. Try unpecompact2, I think there are two versions. http://www.woodmann.com/collaborative/tools/index.php/UnPECompact2_(MadMickael_version) http://www.woodmann.com/...
user avatar
  • 221
3 votes
Accepted

How to cause program to stop execution when a particular value is found in memory

Well, I was tying few weeks ago to implement an ollyscript which triggers conditional beakpoints on each line where a desired alpha/numerical value is found. This program gives the user the choice of ...
user avatar
  • 304
3 votes
Accepted

How do I find a collision for a simple hash algorithm

A Lame brute forcer with an arbitrary seed value using the code you provided finds a few collisions under an hour #include <stdio.h> #include <windows.h> int bitXor(int a,int b) { return (...
user avatar
  • 14.9k
3 votes
Accepted

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

possibilities: Maybe the protection has been changed as @Guntram Blohm said. Have you checked your OllyDBG version. I guess this problem might have been occurred because your version doesn't support ...
user avatar
3 votes

Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter

There are a lot of way to hide strings to the debugger. A simple encryption at runtime can daunt new reverser to work on it. Try this plugin sometimes it helps to find strings that Ollydbg doesn't ...
user avatar
  • 199
3 votes

How can I patch this file?

Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding. That said, in IDA: ...
user avatar
3 votes

how to fix this rsrc data in ida pro?

The Win32 resource data is usually not referenced directly from the code; resource APIs such as FindResource, LoadResource and LockResource are used to access that data. You can use a resource editor ...
user avatar
  • 34.7k
3 votes
Accepted

Assembly and C++

The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use ...
user avatar
  • 34.7k
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
user avatar
  • 1,972
3 votes

IDA PRO - compare running process

What you are asking for is called "Differential Debugging". Take a look to this tutorial to see how to do so with IDA without requiring any kind of plugins, just built-in functionality.
user avatar
  • 4,315
3 votes
Accepted

Has there been any success in using deep learning for reverse engineering?

I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible