3

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly.

I have also tried to use other tools like dotPeek64 and Teleirik without success. Virustotal tell me that it is using:

[+] COMCTL32.dll
[+] ComMgr.dll
[+] KERNEL32.dll
[+] MSVCP90.dll
[+] MSVCR90.dll
[+] OLEAUT32.dll
[+] SHLWAPI.dll
[+] USER32.dll
[+] mfc90.dll

I'm pretty sure it is made with .NET, since this XML is present in the code:

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="removed"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="removed"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>

Also note that I'm using Win8 and do not have VS installed. So my questions are:

  1. What do I need to do to resolve the above error?
  2. What am I missing if anything?
  3. How can I check if I have those *.dll's listed?

EDIT: I'm now thinking it was made with plain C++...

1 Answer 1

3

This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.

6
  • It is a Wn32 exec, but it's probably not a .NET as I first thought, but plain C++. Then what to do?
    – not2qubit
    Commented Feb 6, 2017 at 14:36
  • @not2qubit use appropriate tools, like IDA pro Commented Feb 7, 2017 at 8:46
  • @PawełŁukasik Because that's a $2000+ piece of software. Surely there must be some free alternatives, that is also capable of decompiling unmanaged Win32 code into C-like code.
    – not2qubit
    Commented Feb 7, 2017 at 13:23
  • @not2qubit 30 seconds with search: reverseengineering.stackexchange.com/questions/1817/… Commented Feb 7, 2017 at 13:37
  • @PawełŁukasik I know of all those and more, but I explicitly need a decompiler. As the tools I already mentioned doesn't seem to be able to handle (decompile) anything not made with .NET, I guess I can assume they are useless for my case.
    – not2qubit
    Commented Feb 7, 2017 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.