2

If I have a binary executable containing compiled C code, can I use a hex editor to edit that binary and change a specific instruction into another one, such as nop or jmp? How can I know the offset of the instruction I want to change?

Yes, this is for educational purposes.

Improve this question
2
  • yes, you can use a hexeditor for this. To get the offset, you need a debugger to trace out program flow. As long as your edits don't change overall code size and are replacing one byte with another, it's a "trivial" operation. As soon as you start adding or removing chunks of code, you're in for a world of hurt. Commented Oct 28, 2011 at 19:28
  • @MarcB I was able to turn a call instruction into a nop instruction using a hex editor and a debugger (gdb). Commented Oct 28, 2011 at 19:53

2 Answers 2

Reset to default
5

UPDATE: Sorry, missed the Mach-O tag. This list is really for standard x86, not for Mach-O specifically. Still, it's a nice list for standard x86 code :)

Sure, but you're better off using a tool such as OllyDbg, SoftICE, or Immunity Debugger (a variant of Olly that's designed for reverse engineering). Learning x86 asm isn't actually as difficult as most people make out. You can learn a lot of Win32 assembly from http://win32assembly.online.fr/

You can get a list of opcodes at http://ref.x86asm.net/ if you're really set on editing with a hex editor.

More great tools for this kind of stuff:

  • PE Info (free EXE header editor)
  • CFF Explorer (free EXE header editor / rebuilder. more features than PE Info)
  • PE Explorer (commercial EXE header and resource editor)
  • TrID (file type identifier)
  • PEID (executable / packer identifier)
  • IDA Pro (static executable analysis)
  • procmon (activity analysis)
  • procexp (like taskmgr, but way better and more in depth)
  • ildasm (CIL disassembler)
  • ilasm (CIL assembler)
  • RedGate Reflector (.NET reverse engineering tool)
  • .NET Reflector (.NET reverse engineering tool)
  • XVI32 (hex editor)
  • Hex Workshop (hex editor / structure editor)
Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

A lot of the tools you specified can't interpret MachO binary format. Only one you listed that does is IDA Pro.
My apologies, I missed the MachO tag. All I saw was x86.
4

The de facto tool for doing this and all other forms of binary manipulation is Interactive Disassembler (better known as IDA, comes with a cool free trial!) remember you'll have to rebase the rest of the binary if you change the size of the instruction + operand (I.E changing an x86 nop instruction to a jmp instruction w/ the operands in Mach-O will, more than likely, cause the binary to not run unless you rebase, which IDA of course has an amazing utility for).

A hex editor will not be able to do the same (easily at least).

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.