# Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice.

I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and compiled it using with the official Microsoft SDK with visual studio 2019 as a Release version.

The exe file works with Windows 7 and Windows 10 without any issue.

I searched through IDA and went to the start function which should point where the main user code is, so here are my problems:

1. The start function's analysis has failed and I have failed to find where the code redirects to the CreateProcess function which I used in the code, this is how it looks:

1. When I look up "calc.exe", I find it in a different section, where I'm not used to see it (as compared to the Practical Malware Analysis book examples). This is how it looks:

I have IDA pro 6.8 installed.

This is how the original code looks, the main function only contains a call to the Create() function:

void Create()
{
STARTUPINFO si;
PROCESS_INFORMATION pi;

SecureZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
SecureZeroMemory(&pi, sizeof(pi));

if (!CreateProcess(L"C:\\Windows\\system32\\calc.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
{
printf("failed, error: %d", GetLastError());
}
else {
printf("Process successfuly started!");
}
}


EDIT:

I added to linked PDB file that was in the Release folder and IDA works great and it immediately detects the main function!

But I say to myself, if I'm a malware analyst, I will get the EXE file without any PDB file, so what am I to do?

• Is that start function definitely the main() function, and not the CRT start? Can you look at the imports window to find CreateProcessW and look for XRefs for it? Can you click on the "DATA XREF" for the path string to see where it's used? – Rup Sep 30 '19 at 22:56
• It might also be worth giving IDA the PDB for your code. It should fill in all the symbols correctly for you. – Rup Sep 30 '19 at 23:20
• ok, once I added the pdb file, IDA works like magic! I recognize all the user code easily, but I don't understand what am I to do if I only get the exe file, how will I analyze it..? – just_C Oct 1 '19 at 11:14