18
votes
Accepted
Remove code signature from a Mac binary
There are tools for that, as well as a codesign flag --remove-signature
First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
- 11.7k
8
votes
Accepted
Inject code into exe
Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote:
Another way to copy some code to another process's address space and then ...
- 2,234
6
votes
Binary patching using radare2 in debug mode
This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.
- 482
5
votes
How to edit and modify a class with ILSpy + Reflexil
Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
- 151
5
votes
Accepted
In-memory patching of .net code
Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm
High-level details and implementation for patching and ...
- 20.7k
5
votes
Accepted
Getting Access Violation when patching a program
This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write.
This can happen because that address's page is protected and cannot be written to, ...
- 11.7k
5
votes
translate arm instructions to hex
as i commented to Elians post rasm2 works in windows as is
rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0
you can use keystone / capstone to assemble and disassemble
:\>python
>...
- 16.3k
4
votes
Accepted
IDA & patching question
You don't have to use separate program to patch in ida.
Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte
Then after you are done patching what you need, Edit(...
- 156
4
votes
What's the best way of improving already compiled binary?
To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).
Then, ...
- 11.7k
4
votes
IDAPython Code <-> Data
ah, to create code there is:
create_insn(here())
The last question, when I'm trying to create data from code I'm getting False:
Python>create_byte(here())
False
Python>create_data(here(), ...
- 111
4
votes
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
When does the PE loader fill in the IAT?
The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
- 143
4
votes
Accepted
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
Binary
MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127.
In a 7-bit binary number:
the bit on the right represents a decimal value of 1.
the next bit to the left ...
- 261
3
votes
What's the best way of improving already compiled binary?
Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
- 773
3
votes
Accepted
edit instructions directly in visual mode
This is called assembling - the reverse of "disassembling".
You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet:
wa jnz 0x400d24
- 2,354
3
votes
How to add code to compiled java class
There are several ways to achieve this:
Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
- 36.4k
3
votes
Accepted
Patching a class file inside Jar using bytecode
Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
- 2,002
3
votes
Outputting a patched DLL from x64dbg
You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it.
Generally this happens if you add code at the end of a section. In ...
- 1,652
3
votes
Does V-Table patching (via DLL injection) only work for COM objects/classes?
You are absolutely on the right track
But,
A* a = new A();
...
a->doThing()
Is not going to bother with the vtable at all. Because a can only be of A type. MSVC will still create the vftable, ...
- 684
3
votes
Accepted
Defence against cracking
Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
- 10.9k
3
votes
In reverse engineering, what does it mean to "patch a file"?
Following quote comes from unix.stackexchange:
To patch a file means to modify it, with the connotation that the modification is generally small.
So, patching the executable is a process of ...
- 3,369
3
votes
Accepted
OllyDBG saved executable crashes
So I finally solved my problem. Here a quick explanation on how I did it:
The original problem was that I used "fixed" addresses for the PUSH meaning that it pushes always the same address (which ...
- 51
2
votes
Accepted
Patch methods in COM dll
Debugging COM is indeed a bit on an issue, however you don't necessarily need to debug it in order to retrieve an address to the function you're interested in. Additionally, there are tricks to find ...
- 11.7k
2
votes
Patching a Mach-O Binary Header to remove a LC_SEGMENT
This tool claims it can move and remove load commands. Might be worth a look.
- 121
2
votes
Making application load dll at start
Strange as it is, two other methods have not been mentioned. The AppInit_DLLs approach you mentioned doesn't work anymore to the best of my knowledge. At least not as easily, especially when UEFI ...
- 10.9k
2
votes
Accepted
patch function in ARM binary to always return 0
As you stated, returning in ARM/Thumb is to set the R0 register and return.
You can patch the program a number of ways to do what you want. You can replace the top most instructions with mov r0, 0 ...
- 220
2
votes
Accepted
Are PATCH shims (.sdb's) no longer functional in Windows 10?
From preliminary investigation by Jon, it seems patching functionality has been indeed removed on Windows 10:
I've compared apphelp.dll on Windows 7 versus Windows 10. The Windows
10 version does ...
- 36.4k
2
votes
Remove code signature from a Mac binary
Another blunt way that seemed to work for me on Catalina (note that this strips all attributes):
xattr -cr /path/to/your/program.app
- 21
2
votes
Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program?
it's definitely possible, as keybinding handling has to check for actual pressed key scan codes (comparing it with configured values to branch program to appropriate handler). So if you can locate ...
- 139
2
votes
School project - Cracking a school emulator
As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then ...
- 3,208
Only top scored, non community-wiki answers of a minimum length are eligible