19
votes
lzma: File format not recognized [Details enclosed]
It's a false positive. There is no LZMA-compressed data in the binary.
Running binwalk without any arguments other than the firmware binary file name is equivalent to running it with the -B or --...
- 7,078
12
votes
Accepted
xor eax, eax in x64
In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for ...
- 36.4k
8
votes
Accepted
Changing strings in Hopper Disassembler
You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel.
Then modify whatever you want
You'll need to write a new executable back (⇧⌘E) if you want to save ...
- 1,331
8
votes
how can file size and PE size cant be equal?
"File Size" is the size of the file on disk, according to the file system.
"PE Size" is the value of the SizeOfImage field in the IMAGE_OPTIONAL_HEADER structure in the PE file. Its value is ...
- 20.7k
7
votes
How to view strings in an executable?
If you are running Linux, you can run the strings command to view the hardcoded strings within the binary you are analyzing.
Example:
$ strings my_executable
The strings program is also available ...
- 440
6
votes
Change binary without damage
If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...
- 2,234
5
votes
Inverse And operation
The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed:
0 & 1 = 0
0 & 0 = 0
Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible....
- 8,919
5
votes
Accepted
Change instruction test eax, eax to text eax, 1
The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1.
The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example ...
- 3,369
5
votes
Hooking function with frida
Try using Memory.patchCode to achieve this. Here's a short example.
int test() { return 1024; }
int main(int argc, char **argv) {
printf("%d\n", test());
return 0;
}
When compiled ...
- 2,629
4
votes
Accepted
How to view strings in an executable?
These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as ...
- 11.7k
4
votes
Accepted
is ther a way an app can display a message without the use of messagebox API?
First you need to determine if it is windows message box or not.
What kind of message is in the message box (custom/standard win32/compilation of system strings)? Also an screen-shot would be nice if ...
- 1,384
4
votes
is ther a way an app can display a message without the use of messagebox API?
The MessageBox API just creates a windows dialog and spins in a message loop until it is closed.
A program can do this themselves without using MessageBox, you can look for calls to either ...
- 851
4
votes
how to fix this rsrc data in ida pro?
The Win32 resource data is usually not referenced directly from the code; resource APIs such as FindResource, LoadResource and LockResource are used to access that data. You can use a resource editor ...
- 36.4k
4
votes
Accepted
How do I change a string correctly in IDA Pro?
To understand what's happening, you need to learn about Position Independent Code (PIC).
In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets ...
- 12.9k
4
votes
Accepted
Not able to find Hard coded strings in the mac executable file
Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can ...
- 254
4
votes
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
When does the PE loader fill in the IAT?
The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
- 143
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 2,002
3
votes
How can I patch this file?
Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding.
That said, in IDA:
...
- 12.9k
3
votes
Accepted
Assembly and C++
The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use ...
- 36.4k
3
votes
IDA PRO - compare running process
What you are asking for is called "Differential Debugging". Take a look to this tutorial to see how to do so with IDA without requiring any kind of plugins, just built-in functionality.
- 4,470
3
votes
Accepted
Has there been any success in using deep learning for reverse engineering?
I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the ...
- 1,016
3
votes
Accepted
Find flag from GO binary challenge
Since you have already spent a lot of time on it, I will just show you how to solve it step by step. I recommend you to repeat steps I'm describing, since the best way to learn is to practice.
Tool
I ...
- 3,369
3
votes
In reverse engineering, what does it mean to "patch a file"?
Following quote comes from unix.stackexchange:
To patch a file means to modify it, with the connotation that the modification is generally small.
So, patching the executable is a process of ...
- 3,369
3
votes
Accepted
How can I retrieve the encryption key in this code?
The encryption key is stored in the variable f4800b. It comes out to the following byte array.
43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60
The cipher algorithm used is ...
- 6,040
2
votes
How to view strings in an executable?
To search for strings you could always use radare2 once installed use a terminal to navigate to the directory the file is in then type rabin2 -z filename
- 21
2
votes
Using HEX editor and making 4 chars from 3 chars
As Far As i Know there isn't another way
assume you have a program like this
the hex for this function will look like this
0:000> db main l21
00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
- 16.3k
2
votes
Accepted
Inverse And operation
While there's no way to know with 100% certainty what was the original value before the AND operation, you can find some possible values producing the same result, and sometimes that's enough.
...
- 36.4k
2
votes
Patching a class file inside Jar using bytecode
Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (java -jar -javaagent:YourAgent.jar Target.jar) ...
- 121
2
votes
Accepted
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
the Apis like Sleep are documented a header file is provided in the sdk a library to link against is provided by sdk (windows.h ,kernel32.lib)
api s like Zwxxx are internal or advanced user apis ...
- 16.3k
2
votes
Android app crashes even while not edited, how can I solve it?
W System : ClassLoader referenced unknown path: /data/app/com.ibsbankmobile-1/lib/arm64
E AndroidRuntime: Process: com.ibsbankmobile, PID: 3053
The warning here shows that you have a missing path: /...
- 882
Only top scored, non community-wiki answers of a minimum length are eligible