2

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly.

I have also tried to use other tools like dotPeek64 and Teleirik without success. Virustotal tell me that it is using:

[+] COMCTL32.dll
[+] ComMgr.dll
[+] KERNEL32.dll
[+] MSVCP90.dll
[+] MSVCR90.dll
[+] OLEAUT32.dll
[+] SHLWAPI.dll
[+] USER32.dll
[+] mfc90.dll

I'm pretty sure it is made with .NET, since this XML is present in the code:

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="removed"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="removed"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>

Also note that I'm using Win8 and do not have VS installed. So my questions are:

  1. What do I need to do to resolve the above error?
  2. What am I missing if anything?
  3. How can I check if I have those *.dll's listed?

EDIT: I'm now thinking it was made with plain C++...

3

This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.

  • It is a Wn32 exec, but it's probably not a .NET as I first thought, but plain C++. Then what to do? – not2qubit Feb 6 '17 at 14:36
  • @not2qubit use appropriate tools, like IDA pro – Paweł Łukasik Feb 7 '17 at 8:46
  • @PawełŁukasik Because that's a $2000+ piece of software. Surely there must be some free alternatives, that is also capable of decompiling unmanaged Win32 code into C-like code. – not2qubit Feb 7 '17 at 13:23
  • @not2qubit 30 seconds with search: reverseengineering.stackexchange.com/questions/1817/… – Paweł Łukasik Feb 7 '17 at 13:37
  • @PawełŁukasik I know of all those and more, but I explicitly need a decompiler. As the tools I already mentioned doesn't seem to be able to handle (decompile) anything not made with .NET, I guess I can assume they are useless for my case. – not2qubit Feb 7 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.