-3

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb.

I've searched and skimmed various sites on decompilers but, I haven't been able to figure out the internals. Does the decompiler actually execute the code in someway? (again, I don't want the file to run on my system in any way).

Using a VM is not an option as I have a low-RAM system. What are the risks of running a decompiler to analyze a potentially malicious executable.

| improve this question | |
  • No, static analysis (e.g. IDA and other disassemblers) don't execute the code, they just disassemble it. It can still be exploited (by e.g. crafting a file that exploits a vulnerability in the disassembler), but I think that hasn't even happened yet, so... it's worth the try – rev Jun 5 '15 at 20:53
  • It did happen. – Dominik Antal Jun 5 '15 at 22:14
  • There is already a nice answer to this question: reverseengineering.stackexchange.com/questions/23/… – Dmitry Grigoryev Jun 9 '15 at 15:01
2

Static analysis doesn't execute the code.

You can safely run a decompiler or dissembler against the binary and it will analyze without executing the code. Static analysis by itself can be difficult if the binary is obfuscated and packed. There is a risk where the file could exploit a vulnerability in the program doing the analysis, but this is fairly uncommon, though you should still keep you systems up to date and run as an unprivileged user.

Some disassemblers you could try:

  • objdump. You can use the objdump disassembler to dump the disassembly of the binary. The command objdump -D yourbin will disassemble all sections.
  • IDA Pro. You can grab a free trial of IDA Pro from their website.
  • Hopper. Hopper also has a free trial you can use. Its cost is much cheaper than IDA Pro if you do decide to purchase.

This page lists some decompilers you could try. I haven't tried any of them (except for IDA Decompiler, which is expensive), so I can't vouche for how well they work.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.