17
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.6k
8
votes
Accepted
Inject code into exe
Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote:
Another way to copy some code to another process's address space and then ...
- 2,194
7
votes
Accepted
Replacing small length instruction with larger length instruction
As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:
It's very likely you have a function or 2 in your text segment that are present in ...
- 12.8k
6
votes
Binary patching using radare2 in debug mode
This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.
- 407
5
votes
Accepted
Workflow patching Java jar file
Use JD-GUI to examine the jar file
Unpack the jar file
jar -xf yourapp.jar
Modify the .class file with a Java Bytecode Editor
Use Java Bytecode Editor (JBE)
Repack the modified classes into ...
- 1,998
5
votes
Accepted
Making application load dll at start
You could also add the DLL to the EXE's Import Table. This has the benefit of not loading the DLL into every process that loads user32.dll (which is an issue with #3), and you can do this Import Table ...
- 20.6k
5
votes
Accepted
Getting Access Violation when patching a program
This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write.
This can happen because that address's page is protected and cannot be written to, ...
- 11.6k
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.6k
5
votes
How to edit and modify a class with ILSpy + Reflexil
Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
- 151
5
votes
translate arm instructions to hex
as i commented to Elians post rasm2 works in windows as is
rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0
you can use keystone / capstone to assemble and disassemble
:\>python
>...
- 15.7k
4
votes
Accepted
IDA & patching question
You don't have to use separate program to patch in ida.
Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte
Then after you are done patching what you need, Edit(...
- 156
4
votes
What's the best way of improving already compiled binary?
To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).
Then, ...
- 11.6k
4
votes
IDAPython Code <-> Data
ah, to create code there is:
create_insn(here())
The last question, when I'm trying to create data from code I'm getting False:
Python>create_byte(here())
False
Python>create_data(here(), ...
- 111
4
votes
Accepted
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
Binary
MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127.
In a 7-bit binary number:
the bit on the right represents a decimal value of 1.
the next bit to the left ...
- 156
3
votes
Why use some cracks a patch and a keygen?
One of the possible reasons for this is assymetric encryption used in newer protections. The software vendor has the private key, the public key is embedded in the software. This means you just can't ...
- 12.8k
3
votes
Making application load dll at start
Here's what i did some time ago, when i had your problem.
Use dependency walker to find a DLL that's imported by the main executable, from which the .exe imports only one or two functions. For the ...
- 12.8k
3
votes
Accepted
edit instructions directly in visual mode
This is called assembling - the reverse of "disassembling".
You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet:
wa jnz 0x400d24
- 2,334
3
votes
What's the best way of improving already compiled binary?
Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
- 763
3
votes
How to add code to compiled java class
There are several ways to achieve this:
Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
- 35.6k
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 1,972
3
votes
Outputting a patched DLL from x64dbg
You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it.
Generally this happens if you add code at the end of a section. In ...
- 1,632
3
votes
Does V-Table patching (via DLL injection) only work for COM objects/classes?
You are absolutely on the right track
But,
A* a = new A();
...
a->doThing()
Is not going to bother with the vtable at all. Because a can only be of A type. MSVC will still create the vftable, ...
- 674
3
votes
Accepted
Defence against cracking
Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
- 10.6k
3
votes
In reverse engineering, what does it mean to "patch a file"?
Following quote comes from unix.stackexchange:
To patch a file means to modify it, with the connotation that the modification is generally small.
So, patching the executable is a process of ...
- 3,309
3
votes
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
When does the PE loader fill in the IAT?
The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
- 133
3
votes
Accepted
OllyDBG saved executable crashes
So I finally solved my problem. Here a quick explanation on how I did it:
The original problem was that I used "fixed" addresses for the PUSH meaning that it pushes always the same address (which ...
- 51
2
votes
Making application load dll at start
Strange as it is, two other methods have not been mentioned. The AppInit_DLLs approach you mentioned doesn't work anymore to the best of my knowledge. At least not as easily, especially when UEFI ...
- 10.6k
2
votes
Workflow patching Java jar file
For patching, you're usually better off changing things at the bytecode level, since decompilation and compilation are both lossy operations, whereas bytecode patching will always work, even for ...
- 1,972
2
votes
Patching a Mach-O Binary Header to remove a LC_SEGMENT
This tool claims it can move and remove load commands. Might be worth a look.
- 121
Only top scored, non community-wiki answers of a minimum length are eligible