1

I've been given the task of writing a functional clone for an executable since we don't have the source code.

None of the .NET tools at my disposable recognise it and loading the thing into a text editor, I see the telltale:

MZ...This program cannot be run in DOS mode.

Further down I see:

Microsoft Visual C++ Runtime Library

And further on still:

MultiByteToWideChar

Leading me to conclude it is a C/C++ executable. So far so good.

Without wasting days trying to find a disassembler, is there anything that could help me glean any further information from this type of executable? I already know about Sysinternals Strings application. I've also found something that can dump the assembly code (for all the good this does me!).

Improve this question
6
  • 6
    If you are looking for a magic bullet I have to disappoint you. The best you'll really get is IDA pro for reverse engineering and that is time consuming. The best way is probably write tests for the current exe, and then build your new exe to be compliant with the tests.
    – djgandy
    Jul 11 '16 at 9:28
  • 1
    Have a look at excellent article Peering Inside the Windows Portable Executable by Matt Pietrek.
    – MNS
    Jul 11 '16 at 10:03
  • The old tool, PEiD was often useful. IDA Pro is unparalleled - quite useful for such a task. The (IDAPro) ability to turn binary code into a flowchart doesn't exactly suck...
    – enhzflep
    Jul 11 '16 at 10:16
  • @djgandy My hopes weren't high. They're happy with a functional clone but they're just nervous about any undocumented edge cases...
    – Robbie Dee
    Jul 11 '16 at 15:01
  • some apps have main functionalities located inside DLL's in such case you can use them directly and the app is just front end form calling functions from DLL's. Otherwise it is usually much faster to encode the App from scratch mirroring functionality then dive into disassembling and hoping that disassembled stuff will make some sense or even work as should.
    – Spektre
    Jul 14 '16 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy