Hot answers tagged


Although this question is a bit broad, I feel that I can provide an acceptable answer by at least explaining some ways that I've used file format structures in reversing. First of all, a reverse engineer "in the workforce" always has some goal. For example, a malware analyst working at an antivirus company may analyze a sample to: Learn how the same works ...


If you don't have the GetProcAddress() function, you have to iterate entire export table, here a example how i made it in the past... template<typename INTH_T> NTSTATUS GetRemoteProcAddressArch(HANDLE hProcess, HMODULE ModuleHandle, LPCSTR RoutineName, PULONG_PTR hRoutine) { HMODULE hModule = GetModuleHandleA("Ntdll.dll"); if(!hModule) ...


You can extract some file from .exe using pyi-archive_viewer, modify them and put back. But be attention, all files in .exe are compressed using DEFLATE (zlib.compress() - you can watch this in source code of PyInstaller). So, when putting back you need compress file to the exact size, that was when you extracted it.

Only top voted, non community-wiki answers of a minimum length are eligible