41–50 of 90 posts
Earlier quoted context omitted.
There's an evaluation version of IDA that's an older version and doesn't include 64-bit disassembly (just x86 and ARM IIRC), but it's free.
And is not available for my operating system.
Earlier quoted context omitted.
As long as all the instructions are the same size (or smaller padded with no-operation instructions) then yes. If, however, you do change the size of the application all relocation deltas need to be changed, and all relative jumps and calls need to be recalculated.
There are sometimes tricks that get you around this problem, too: you can sometimes patch in a trampoline, which gives you some flexibility in the instructions you get to use.
Honestly, do we really need another static analysis tool? Hopper and radare2 have covered the open source gap fairly well. I'd put r2 on near-power-parity of IDA if you invest the time to learn and configure it, which admittedly is an expensive proposition in labor who already knows IDA. It'll take him more days in salary to learn a new platform than just to pay the 5k and get him a IDA/HexRays license.
[1] U of Maryland holds the patent; information here, https://www.google.co.uk/patents/US8510723 [2] https://www.cs.umd.edu/class/fall2005/cmsc714/Lectures/byrd-... Though, I'm sure you've seen it already
Earlier quoted context omitted.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
As long as all the instructions are the same size (or smaller padded with no-operation instructions) then yes. If, however, you do change the size of the application all relocation deltas need to be changed, and all relative jumps and calls need to be recalculated.
Author here. Panopticon grew out of my frustration about the lack of usable implementations of cutting-edge program analysis research and the fact that the industry standard for RE is a proprietary software that looks like Windows 95. I toyed with the idea of rewriting it in Rust since 1.0 became stable. The whole port took around 3 months. I got the size down from 10.000 to 8.000 loc. Looking back it was the right d…
Earlier quoted context omitted.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
Yes, there's no recompiling that can be done anyway if you only have the binary and no source code. Writing the new machine code would overwrite some code at the start of the function you're modifying, but that doesn't matter if you just want the function to return true or false. You could edit the binary manually with a hex editor, but some disassemblers like Hopper have a feature where you can type new instructions…
[1] https://github.com/iphelix/ida-patcher/blob/master/idapatche... is what I have in my scripts dir, but I'm sure there are dozens of others out there. That specific Python script has the added benefit of being really approachable for the average user. Check Woodmann or Github or wherever people post their scripts these days if it doesn't meet your needs. [2] IDA's basically turned into emacs, where the real power comes from all of the tooling you can conf into it. A stock 6.9 + HexRays license is worth it just for the free tooling you can find.
Earlier quoted context omitted.
Usually. Just make sure the new machine code is the same size as the old. That said, if the code is signed and there's a signature check - the check will fail if you modify the code. If the signature is a simple crc/checksum, you could also update the checksum. If it's a cryptographic signature, it might be a lot more difficult.
Or, you also have to modify the check code.
Earlier quoted context omitted.
As long as all the instructions are the same size (or smaller padded with no-operation instructions) then yes. If, however, you do change the size of the application all relocation deltas need to be changed, and all relative jumps and calls need to be recalculated.
i was trying to edit one byte in an ELF, no change in file size and it kept crashing. i read that each section of code is hashed and obviously my byte edit changed the hash. i was pretty out of my depth tbh.
Earlier quoted context omitted.
You insert the equivalent of "mov eax, 0x1; ret" (or 0x0) in x86 for whatever architecture you're using as the first instructions of the function.
I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?
Earlier quoted context omitted.
Or, you also have to modify the check code.
Huh? Isn't that what he said - or did I miss something? How is your check code related comment different from his checksum related statement?
Earlier quoted context omitted.
Or, you also have to modify the check code.
Huh? Isn't that what he said - or did I miss something? How is your check code related comment different from his checksum related statement?