Hot answers tagged

2

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand". First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...


1

Relative Virtual Address = RVA it is relative within the address space jmp here+78 will always jump +78 from wherever here is now jump 402078 will always try to jump to 402078 this will only succeed if 402078's preferred loading address was 400000 and the binary loaded at 400000 if it loaded at 600000 then 402078 does not exist in that address space and ...


1

You can use r2 to get the data and r2pipe to script it. iS entropy produce the entropy values for each section. Adding j will produce it in JSON format and scripting it with r2pipe is easy. import r2pipe p = r2pipe.open('<path_to_exe>') res = p.cmdj('iSj entropy') print([(x['name'],x['entropy']) for x in res['sections']]) [('.text', '6.00602992'), ('....


Only top voted, non community-wiki answers of a minimum length are eligible