1

I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a non-English speaker, the interface/presentation of it needs to be cleaned up to make it look a little more professional. Is it possible to get to the file's source code and edit it?

4

Principally: Yes.
But: it's not practically.

You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need to do it at least in assembly language.
If you want to improve the software, I think, the best would be to contact the developer and ask if you can help him to improve the software.

If you want to take a look inside the .exe anyway you could try OllyDbg.

If you want to change something in such an existing program, you have basically 3 ways to do it:

  1. Changing the machine code itself:
    The representation of the machine code does not need to be 1's and 0's, you can use any other number system. Anyway machine code is really, really hard to read and edit. Additionally you have also the same problems like you 'simply' disassemble the program.

  2. Use a disassembler and modify the assembler code:
    You have to take care of the memory layout of the software you want to modify. Since any change on some string could override another variable. And assembler is also not easy to read and write. So depending on the size of the software, it takes some time to get a basic overview about where to change the code.

  3. Or use a decompiler:
    But you mostly won't get any useful variable names, since the compiler removes them most of the time.

Another point you have to take a look at is anti debugging and reverse engineering tools. They may prevent from running the piece of code inside debugger like OllyDbg or getting useful decompiled code.
Also take a look at peter ferrie's answer.

  • It's a very old program, definitely DOS on further inspection, and the original website it came from has been down a while, so getting in touch with the developer is out of the question. Could you explain why it would be impractical to change the presentation of the code? By machine-code are we talking as basic as it gets - 1s and 0s? – Hashim Jan 2 '16 at 0:04
  • I've extended my answer above. I hope it's more understandable now. If not, please leave a comment about it, and I will try to help out. – falx Jan 2 '16 at 9:44
  • Thanks so much for the detailed answer. A few hours of research after asking this, I came to understand everything you've added, and decided instead to go with using a Hex editor (which you might want to include in that list of ways to edit an existing program). Using a combination of OllyDbg and Hxd, I managed to find what I want, but ran into another problem, which I've detailed here:reverseengineering.stackexchange.com/questions/11676/…. If you could help answer that question, I'd really appreciate it. – Hashim Jan 3 '16 at 1:54
  • 1
    Using a hexeditor is just a way to maipulate the machine-code itself. So it's already included ;). I'll take a look at your other question. – falx Jan 3 '16 at 9:46
2

The short answer is no - the source is not available if only the .exe is available. The source code is an entirely separate file which is generally not shared with the public. However, given the .exe file, it might be possible to "decompile" it into a form of source code which would allow a new .exe file to be produced, and which should match the existing one fairly well when performing a byte-for-byte comparison.

With that decompiled source code in hand, it would be possible to make modifications to the behavior or appearance of the program, but it would be far from trivial, since such relatively important things as variable names will not be present, so deriving the meaning of certain memory accesses will require a lot of time and effort.

You would need to consider carefully if the effort is worth the reward.

protected by Community Nov 25 '18 at 12:35

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.