Let's assume you have reversed engineered some kind of boolean check and you now want to patch it to always return true or false. What does that process look like at a high level?
Panopticon: A libre, cross platform disassembler for reverse engineering
11–20 of 90 posts
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#12Let's assume you have reversed engineered some kind of boolean check and you now want to patch it to always return true or false. What does that process look like at a high level?
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#13Let's assume you have reversed engineered some kind of boolean check and you now want to patch it to always return true or false. What does that process look like at a high level?
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#14Earlier quoted context omitted.
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
As long as all the instructions are the same size (or smaller padded with no-operation instructions) then yes. If, however, you do change the size of the application all relocation deltas need to be changed, and all relative jumps and calls need to be recalculated.
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#15Earlier quoted context omitted.
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
Yes, there's no recompiling that can be done anyway if you only have the binary and no source code. Writing the new machine code would overwrite some code at the start of the function you're modifying, but that doesn't matter if you just want the function to return true or false.
You could edit the binary manually with a hex editor, but some disassemblers like Hopper have a feature where you can type new instructions in assembly and it will assemble and insert them for you. I'm sure IDA pro has something like that as well.
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#16I like "ht editor".
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#17Earlier quoted context omitted.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
As long as all the instructions are the same size (or smaller padded with no-operation instructions) then yes. If, however, you do change the size of the application all relocation deltas need to be changed, and all relative jumps and calls need to be recalculated.
There are sometimes tricks that get you around this problem, too: you can sometimes patch in a trampoline, which gives you some flexibility in the instructions you get to use.
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#18Anyone know how this compares to IDA Pro ?
If you can afford an IDA Pro license and cost of plugins, does it matter?
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#19Earlier quoted context omitted.
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
Yes you can. An executable (using ELFs as an example, most formats are similar) is nothing more than some headers and bytes. The executable code can be modified in any way you please, as long as you're writing valid opcodes (the program will crash if it hits a bad opcode).
That said, it's usually much more complicated to change the size of the executable section (this requires modifying the headers and this tends to be a rather involved process), so usually if people are doing binary patches they are only modifying bytes, not adding or removing them.
Re: Panopticon: A libre, cross platform disassembler for reverse engineering
#20Anyone know how this compares to IDA Pro ?
If you can afford an IDA Pro license and cost of plugins, does it matter?
Yeah, it matters. If this is better, I'll use this; if IDA is better, I'll use IDA. I'm not 100% sure I understand your comment.
Btw, most companies can afford an IDA license. It's pretty cheap compared to the salary of a developer, at least in the coastal US.