2

You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-made antitampering routine. Even those advanced methods become eventually studied and cracked. Either you have to rely on commercial protections (maybe ...


2

Since you are dealing with a dot Net application, this will be super easy. As dot Net application are 'compiled' using an Intermediate Language (IL), you may be able to recover something very close to the original source code. If the binary is not obfuscated/protected, you just have to open-up your application in a .NET editor. DnSpy is the one that I find ...


1

As expected, the USB was indeed detected but due that Linux has no idea how to deal with it without a proper driver, it only parses its hardware related parameters (Vendor and Product IDs) and stops there. Here are the USB device's entries in usb-devices and lsusb commands respectively: # usb-devices [...] T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 8 ...


1

There's an entry in the relocation table that is pointing to that location, so the value is being adjusted according to the load-address. To fix the problem, you'll have to find that entry and disable it. The simplest change is to make the entry empty so that it's skipped, as opposed to copying all following entries over this one and reducing the count.


1

Patching in IDA is pretty simple and well documented here and here. First, you need to make the change by selecting a portion of data in the main view and then use the Edit -> Patch program -> Change word submenu item. Note that at that point the change was only made to the IDB you're working on and not to the actual binary you loaded. Before applying ...


1

Version tracking in ghidra is exactly what you are looking for. Say you have two binaries with different versions. First, you need to analyze those binaries and save the analysis results (you can manually patch binary before or during this stage). Then click on version tracking symbol and create new version tracking session. Here, you can track and apply ...


1

This is an unconditional branch (thumb) It is encoded as 11100|signed 11-bit immediate offset E 7 D 2 1110 0111 1101 0010 so your 11-bit offset is 0b11111010010. This is sign extended to -46 The operation is: PC = PC + (SignExtend(signed_immed_11) << 1) where the first PC contains the address of the branch plus 4. 0x176E4 + 4 + (-46 * 2) ==...


Only top voted, non community-wiki answers of a minimum length are eligible