Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-

reverse engineering exe file

Name: Anonymous 2012-07-06 5:12

so, usual spam mail, usual bogus url i SHOULD REALLY CLICK.
for a change, i opened said url on a debian VM, downloaded the "harmless" zip file and now i have this innocent .exe looking at me with puppy eyes because there is no System32 to crap into.
now, back to the title:
is there a nice tool to reverse engineer the little bugger, possibly not a single-language "decompiler" sure to shit everything up said bugger was code in another one?

any help/tip appreciated

Name: Anonymous 2012-07-06 5:30

Your text is hard as hell to read. Learn to write properly.

If I understood your question correctly, you want to reverse engineer Windows executable file.

Here are some solutions:
- You can use objdump to dump disassembly and some symbol information
- You can use OllyDBG to debug the file
- You can buy (pirate) IDA PRO and use it's superior dissassemble/code analysis stuff to figure shit out
- You can go out

Name: Cudder !MhMRSATORI!fR8duoqGZdD/iE5 2012-07-06 6:36

http://radare.org/

>>2
It will almost certainly be packed so objdump isn't going to show much. Loading it in a debugger is not really advised either, as they know about these sorts of things and won't make it easy for you. Anti-debugging, obscure tricks that can force a debugger to start running it even by just loading the file, etc. Your best bet is to use a framework like above and do a static, carefully controlled unpack first.

Name: Anonymous 2012-07-06 7:01

>>2
IDA looks fucking awesome, thnx

Name: Anonymous 2012-07-06 7:05

Run it inside a VM and look what happens.

Name: 2 2012-07-06 8:09

>>3
Interesting, thanks.

Name: Anonymous 2012-07-06 8:32

>>2

There is IDA Free version.

And not a while ago ESET's internal keys was stolen.

And OP's writing isn't hard to read.

Name: Anonymous 2012-07-06 10:35

Run it on your computer normally and look what happens.

Name: Anonymous 2012-07-06 12:20

>>2
- You can go out
Surely you jest!

Name: Anonymous 2012-07-06 14:58

PE Explorer.

Don't change these.
Name: Email:
Entire Thread Thread List