Modifying and running a binary by recompiling a reverse engineered disassembly(devever.net)

Modifying and running a binary by recompiling a reverse engineered disassembly

https://www.devever.net/~hl/recompile

4 comments

> Either way, you want to start with a working binary and gradually replace some parts of it (but not others) with C code as you gradually understand more of the binary.

The author found RetDec, but might not have known about McSema[1] and other binary lifters. The latter have this exact goal in mind: you lift the original binary to LLVM IR (and then potentially to C[2]) to perform transformations.

[1]: https://github.com/lifting-bits/mcsema

[2]: https://github.com/lifting-bits/rellic

FD: My company's work. But I don't currently work on either of those tools.

pgp00há 6 anos

Here is a tool you might be interested in: https://egalito.org/

pzbitskiyhá 6 anos

Reminds me early of 2000s when I taught code-rip techniques by extracting and fine-tuning a shuffling algorithm from a popular mp3 player, then re-assembling as PIC and inserting back to the binary.

djmipshá 6 anos

This exposition is about a 2001 era exe compiled with MSVC6.