0

I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-bit executable. However, my instructor said that does not suffice.

How can I determine if this binary is primarily 32-bit Intel code without involving simply the metadata. I have a suite of tools at my disposal such as IDA-Pro, PEView, etc etc.

  • This is a pretty broad question, for what purpose do you need to determine if a binary is composed of mostly 32-bit code? composed of 32-bit code compared to what, 64-bit code? data? Voting to close as this question is too vague – NirIzr Jan 29 '18 at 2:35
  • Check the opcodes, and see if if they correspond to x86 or x64 instructions? – Dominik Antal Jan 29 '18 at 11:20
  • The purpose was to determine if the code was primarily 32-bit code versus say python scripts. I was able to use some of the tools available to determine the composition. – Midge_Mong Jan 29 '18 at 16:15
0

what you mean by metadata
do you mean the details in header that denotes machine

:\>dumpbin /headers .\x64\x64dbg.exe | grep -i machine
            8664 machine (x64)

:\>dumpbin /headers .\x32\x32dbg.exe | grep -i machine
             14C machine (x86)
                   32 bit word machine

if you can't use it then can you disassemble the binary
if yes you can look for x64 register usage
if you find some registers like rax rbx etc then it is probably 64 bit else 32 bit

:\>dumpbin /disasm x32\x32dbg.exe | grep -ic "r.x"
0

:\>dumpbin /disasm x64\x64dbg.exe | grep -ic "r.x"
801

:\>

or you can check the reloc section if it has a highlow reloc it is possibly 32 bit
and a DIR64 reloc indicates a 64 bit exe

:\>dumpbin /relocations /nologo x32\x32dbg.exe | grep -A 2 -i rva
    1000 RVA,       E0 SizeOfBlock
       1  HIGHLOW            00402A00
      11  HIGHLOW            00402A10
--
    2000 RVA,      148 SizeOfBlock
       2  HIGHLOW            0040308C
       8  HIGHLOW            00403090
--
    3000 RVA,       C8 SizeOfBlock
     140  HIGHLOW            00402229
     144  HIGHLOW            00401000
--
    5000 RVA,       18 SizeOfBlock
       0  HIGHLOW            00403438
       4  HIGHLOW            0040346C

:\>dumpbin /relocations /nologo x64\x64dbg.exe | grep -A 2 -i rva
    3000 RVA,       58 SizeOfBlock
     278  DIR64      00000001400023DC
     280  DIR64      0000000140001000
--
    5000 RVA,       18 SizeOfBlock
       0  DIR64      0000000140003630
       8  DIR64      0000000140003680
0

A simple way would be to open up the executable in IDA and look at the navigation bar. If most of it is blue or brownish red, rather than gray or brownish yellow then the executable contains mostly code.

Not the answer you're looking for? Browse other questions tagged or ask your own question.