I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to bypass the file entirely. I have attempted among other things to open the file with ollydbg.
Olly states that it is probably not a win32 application, upon accepting that, olly is unable to start the program. Log says nothing. Yet the program starts perfectly in a normal context. After some reading it seems clear to me that the author must have exploited the PE header in some way to confuse the debugger.
My question is, surely there must be plugins or debuggers out there that can closer mimic the windows loader, and therefore can run these files, if so can you list an example?
I say this because i can open the file in resource hacker,but again PEid does not.
P.S - Starting the program and then attempting to attach does nothing as the process is not listed.
What I've Read:
RESE - Basically messed with PE to the point where windows wouldn't load the exe
RESE - Specific only to Resource Hacker (which funnily enough works)
RESE - Does not seem to give a way to combat
RESE - Explains of methods for other resource editors, is there a method for Olly
Virus Bulletin - Explains PE manipulation, introduces PeSweep
PE Header (Not complete):
