0

What are some methods to reverse a ex5 file, for metatrader 5? I would like to understand how people crack ex5 files and make them for use. Any ideas of reverse engineering tools for this scenario?

1
  • Metatrader has a proprietary compiler and executable format, you'd want to analyze metaeditor.exe
    – mimak
    Commented Jun 18, 2023 at 8:13

1 Answer 1

0

MetaTrader's .ex4 and .ex5 binaries are a custom format designed to run inside MetaTrader's platform. I assume most of the information on these is contained in metaeditor.exe, the platform's cross-version IDE and compiler.

Just recently I've tried to analyze MetaEditor out of curiosity - the IDE and compiler are statically obfuscated and have anti-debugging measures employed.

If you like challenges though, probably the first step for you would be attaching the process to a debugger. Here's a little gist with my attempt that you can start with.

5
  • Yeah that is one option. I was also thinking about analyzing the terminal.exe file which may give hints as well. However once modifying the call stacks seems like terminal.exe doesn't want to open metatrader5. The thing with analyzing metaeditor.exe is that metaeditor.exe is not responsible for loading the EA and making webrequests right? That was would be the responsibility of terminal.exe. I am also using x64dbg
    – The Coder
    Commented Jun 18, 2023 at 14:33
  • I believe the terminal runs some kind of VM or an interpreter which executes the bytecode, the editor is mostly interesting because of the compiler. One way or another you will have to bypass anti-debugging, both are protected
    – mimak
    Commented Jun 19, 2023 at 12:05
  • I've tried scyllahide however the execution times out when stepping through. Any ideas how to get through the anti-debugging. Also how do I modify a string in x64debug. mov rax,qword ptr ss:[rsp+E8] | [rsp+E8]:L"C:\\Program Files\\FTMO MetaTrader 5\\"<--- I want to change the path.
    – The Coder
    Commented Jun 19, 2023 at 21:08
  • After analyzing metaeditor.exe how would I decompile the ex5 file? Some steps would be nice. @mimak
    – The Coder
    Commented Aug 17, 2023 at 23:16
  • @TheCoder use Scylla to make a memory dump of the process and analyze it with Ghidra or a different decompiler of choice
    – mimak
    Commented Aug 17, 2023 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.