18 votes
Accepted

Remove code signature from a Mac binary

There are tools for that, as well as a codesign flag --remove-signature First two should work the same. The codesign flag is undocumented and so YMMV (A user reported in a comment the codesign ...
NirIzr's user avatar
  • 11.7k
8 votes
Accepted

Inject code into exe

Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote: Another way to copy some code to another process's address space and then ...
dsasmblr's user avatar
  • 2,234
6 votes

Binary patching using radare2 in debug mode

This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.
pancake's user avatar
  • 482
5 votes

How to edit and modify a class with ILSpy + Reflexil

Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
Alien_AV's user avatar
  • 151
5 votes
Accepted

In-memory patching of .net code

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm High-level details and implementation for patching and ...
Jason Geffner's user avatar
5 votes
Accepted

Getting Access Violation when patching a program

This error means that the processor tried to access the address at 0x004003F8 and failed. The access type was write. This can happen because that address's page is protected and cannot be written to, ...
NirIzr's user avatar
  • 11.7k
5 votes

translate arm instructions to hex

as i commented to Elians post rasm2 works in windows as is rasm2 -a arm -b 32 "add r0, r1, r2" will return 020081e0 you can use keystone / capstone to assemble and disassemble :\>python >...
blabb's user avatar
  • 16.3k
4 votes
Accepted

IDA & patching question

You don't have to use separate program to patch in ida. Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)>>patch byte Then after you are done patching what you need, Edit(...
Storm Shadow's user avatar
4 votes

What's the best way of improving already compiled binary?

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments). Then, ...
NirIzr's user avatar
  • 11.7k
4 votes

IDAPython Code <-> Data

ah, to create code there is: create_insn(here()) The last question, when I'm trying to create data from code I'm getting False: Python>create_byte(here()) False Python>create_data(here(), ...
eXp's user avatar
  • 111
4 votes

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

When does the PE loader fill in the IAT? The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/...
plowsec's user avatar
  • 143
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
Bavi_H's user avatar
  • 261
3 votes

What's the best way of improving already compiled binary?

Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse ...
LUser's user avatar
  • 773
3 votes
Accepted

edit instructions directly in visual mode

This is called assembling - the reverse of "disassembling". You can do so with the command wa (presumably, "write assembly"). It can be found in the Radare2 cheat sheet: wa jnz 0x400d24
Jongware's user avatar
  • 2,354
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
Igor Skochinsky's user avatar
  • 36.4k
3 votes
Accepted

Patching a class file inside Jar using bytecode

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible ...
Antimony's user avatar
  • 2,002
3 votes

Outputting a patched DLL from x64dbg

You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it. Generally this happens if you add code at the end of a section. In ...
mrexodia's user avatar
  • 1,652
3 votes

Does V-Table patching (via DLL injection) only work for COM objects/classes?

You are absolutely on the right track But, A* a = new A(); ... a->doThing() Is not going to bother with the vtable at all. Because a can only be of A type. MSVC will still create the vftable, ...
Abigail's user avatar
  • 684
3 votes
Accepted

Defence against cracking

Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
0xC0000022L's user avatar
  • 10.9k
3 votes

In reverse engineering, what does it mean to "patch a file"?

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of ...
bart1e's user avatar
  • 3,369
3 votes
Accepted

OllyDBG saved executable crashes

So I finally solved my problem. Here a quick explanation on how I did it: The original problem was that I used "fixed" addresses for the PUSH meaning that it pushes always the same address (which ...
skudo's user avatar
  • 51
2 votes
Accepted

Patch methods in COM dll

Debugging COM is indeed a bit on an issue, however you don't necessarily need to debug it in order to retrieve an address to the function you're interested in. Additionally, there are tricks to find ...
NirIzr's user avatar
  • 11.7k
2 votes

Patching a Mach-O Binary Header to remove a LC_SEGMENT

This tool claims it can move and remove load commands. Might be worth a look.
Timmmm's user avatar
  • 121
2 votes

Making application load dll at start

Strange as it is, two other methods have not been mentioned. The AppInit_DLLs approach you mentioned doesn't work anymore to the best of my knowledge. At least not as easily, especially when UEFI ...
0xC0000022L's user avatar
  • 10.9k
2 votes
Accepted

patch function in ARM binary to always return 0

As you stated, returning in ARM/Thumb is to set the R0 register and return. You can patch the program a number of ways to do what you want. You can replace the top most instructions with mov r0, 0 ...
Ghassan Idriss's user avatar
2 votes
Accepted

Are PATCH shims (.sdb's) no longer functional in Windows 10?

From preliminary investigation by Jon, it seems patching functionality has been indeed removed on Windows 10: I've compared apphelp.dll on Windows 7 versus Windows 10. The Windows 10 version does ...
Igor Skochinsky's user avatar
  • 36.4k
2 votes

Remove code signature from a Mac binary

Another blunt way that seemed to work for me on Catalina (note that this strips all attributes): xattr -cr /path/to/your/program.app
user31463's user avatar
2 votes

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program?

it's definitely possible, as keybinding handling has to check for actual pressed key scan codes (comparing it with configured values to branch program to appropriate handler). So if you can locate ...
agg3l's user avatar
  • 139
2 votes

School project - Cracking a school emulator

As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then ...
Remko's user avatar
  • 3,208

Only top scored, non community-wiki answers of a minimum length are eligible