2

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to bypass the file entirely. I have attempted among other things to open the file with ollydbg.

Olly states that it is probably not a win32 application, upon accepting that, olly is unable to start the program. Log says nothing. Yet the program starts perfectly in a normal context. After some reading it seems clear to me that the author must have exploited the PE header in some way to confuse the debugger.

My question is, surely there must be plugins or debuggers out there that can closer mimic the windows loader, and therefore can run these files, if so can you list an example?

I say this because i can open the file in resource hacker,but again PEid does not.

P.S - Starting the program and then attempting to attach does nothing as the process is not listed.

What I've Read:

RESE - Basically messed with PE to the point where windows wouldn't load the exe

RESE - Specific only to Resource Hacker (which funnily enough works)

RESE - Does not seem to give a way to combat

RESE - Explains of methods for other resource editors, is there a method for Olly

Virus Bulletin - Explains PE manipulation, introduces PeSweep

PE Header (Not complete): PE Header - Not complete

  • if Olly can't load the file, then Windows can't load the file. If you don't see the PE header, then it's not a PE file. – peter ferrie Aug 19 '16 at 16:04
  • There is a PE header. Windows can run the file. I will update with picture. – RandomHash Aug 19 '16 at 16:05
  • 1
    ah, this is a 64-bit executable. you can tell that by the value after the "PE" signature - "8664" is 64-bit. "014C" is 32-bit. Olly doesn't understand 64-bit executables. – peter ferrie Aug 19 '16 at 16:11
  • Try x64dbg it is wip but should be able to provide some info – blabb Aug 19 '16 at 16:39
  • ah! a rookie mistake :( i should have really got that. Thanks :) – RandomHash Aug 19 '16 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.