16 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
  • 11.5k
8 votes
Accepted

Inject code into exe

Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote: Another way to copy some code to another process's address space and then ...
  • 2,174
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
6 votes

How do the internals of a Windows update security patch work?

I just downloaded the KB2977629 patch file (IE11-Windows6.1-KB2977629-x64.MSU). It looks like the information about which file corresponds to what is inside the _manifest_.cix.xml file (there is a ...
  • 165
6 votes

Are there any modern assembly-level patching tools?

I regularly use radare2 for patching binaries. It works quite well, it's free (as in freedom), and scriptable.
  • 61
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
5 votes
Accepted

Getting Access Violation when patching a program

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, ...
  • 11.5k
5 votes
Accepted

Workflow patching Java jar file

Use JD-GUI to examine the jar file Unpack the jar file jar -xf yourapp.jar Modify the .class file with a Java Bytecode Editor Use Java Bytecode Editor (JBE) Repack the modified classes into ...
5 votes
Accepted

Making application load dll at start

You could also add the DLL to the EXE's Import Table. This has the benefit of not loading the DLL into every process that loads user32.dll (which is an issue with #3), and you can do this Import Table ...
5 votes

How to edit and modify a class with ILSpy + Reflexil

Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
  • 151
5 votes

translate arm instructions to hex

as i commented to Elians post rasm2 works in windows as is rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0 you can use keystone / capstone to assemble and disassemble :\>python >...
  • 15.3k
4 votes
Accepted

Are there any modern assembly-level patching tools?

If you have IDA pro, IDA patcher was released recently. While I haven't used it personally, it won one of the Hexrays plugin contests, and is probably pretty reasonable. https://thesprawl.org/...
  • 56
4 votes
Accepted

IDA & patching question

You don't have to use separate program to patch in ida. Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte Then after you are done patching what you need, Edit(...
4 votes

What's the best way of improving already compiled binary?

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments). Then, ...
  • 11.5k
4 votes

IDAPython Code <-> Data

ah, to create code there is: create_insn(here()) The last question, when I'm trying to create data from code I'm getting False: Python>create_byte(here()) False Python>create_data(here(), ...
  • 111
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
  • 156
3 votes

Are there any modern assembly-level patching tools?

There are a few really great options. First, something that I frequently forget when doing patching is that LD_PRELOAD makes hooking/redirecting library routines very easy. If you must patch ...
  • 2,287
3 votes

Making application load dll at start

Here's what i did some time ago, when i had your problem. Use dependency walker to find a DLL that's imported by the main executable, from which the .exe imports only one or two functions. For the ...
3 votes
Accepted

edit instructions directly in visual mode

This is called assembling - the reverse of "disassembling". You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet: wa jnz 0x400d24
  • 2,304
3 votes

What's the best way of improving already compiled binary?

Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
  • 733
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
  • 35.2k
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
  • 1,972
3 votes

Outputting a patched DLL from x64dbg

You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it. Generally this happens if you add code at the end of a section. In ...
  • 1,612
3 votes

Does V-Table patching (via DLL injection) only work for COM objects/classes?

You are absolutely on the right track But, A* a = new A(); ... a->doThing() Is not going to bother with the vtable at all. Because a can only be of A type. MSVC will still create the vftable, ...
  • 664
3 votes
Accepted

Defence against cracking

Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
  • 10.6k
3 votes

In reverse engineering, what does it mean to "patch a file"?

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of ...
  • 3,229
3 votes

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

When does the PE loader fill in the IAT? The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
  • 133
3 votes
Accepted

OllyDBG saved executable crashes

So I finally solved my problem. Here a quick explanation on how I did it: The original problem was that I used "fixed" addresses for the PUSH meaning that it pushes always the same address (which ...
  • 51
2 votes

Making application load dll at start

Strange as it is, two other methods have not been mentioned. The AppInit_DLLs approach you mentioned doesn't work anymore to the best of my knowledge. At least not as easily, especially when UEFI ...
  • 10.6k

Only top scored, non community-wiki answers of a minimum length are eligible