Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries.
Is there a particular tool that tells me EVERYTHING an installer/executable does? This is regarding the Windows platform.
It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity:
If you need to examine the details of the network traffic, Wireshark will let you capture and see all network communications:
These two tools should satisfy your ask for "a particular tool that tells me EVERYTHING an installer/executable does?". If, on the other hand, you need to see everything that an installer/executable could do, then you'd need to use a disassembler like IDA Pro to examine all possible code paths, but note that this is much more time-consuming and challenging than using the other two tools described above.
You may wish to use a tool called RegShot for monitoring changes in the registry. You would take a snapshot of the registry, and then run the suspicious program, any changes will be highlighted by RegShot in the next snapshot you take - RegShot - Sourceforge
