so, usual spam mail, usual bogus url i SHOULD REALLY CLICK.
for a change, i opened said url on a debian VM, downloaded the "harmless" zip file and now i have this innocent .exe looking at me with puppy eyes because there is no System32 to crap into.
now, back to the title:
is there a nice tool to reverse engineer the little bugger, possibly not a single-language "decompiler" sure to shit everything up said bugger was code in another one?
any help/tip appreciated
Name:
Anonymous2012-07-06 5:30
Your text is hard as hell to read. Learn to write properly.
If I understood your question correctly, you want to reverse engineer Windows executable file.
Here are some solutions:
- You can use objdump to dump disassembly and some symbol information
- You can use OllyDBG to debug the file
- You can buy (pirate) IDA PRO and use it's superior dissassemble/code analysis stuff to figure shit out
- You can go out
>>2
It will almost certainly be packed so objdump isn't going to show much. Loading it in a debugger is not really advised either, as they know about these sorts of things and won't make it easy for you. Anti-debugging, obscure tricks that can force a debugger to start running it even by just loading the file, etc. Your best bet is to use a framework like above and do a static, carefully controlled unpack first.