4

x64dbg can load the pdb and list all the function names if you have pdb for your executable view->modules->download symbols for this module also x64dbg can use the source file (ctrl+shift+s) just for completion sake windbg usage :\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64 ...


2

No it does not all pe files do not start at the same address 0x401000 historically 0x400000 is the ImageBaseAddress Header is 0x1000 bytes so .code section starts at 0x401000 for a normal exe since the Exe's module is the first to be loaded it normally gets its Preferred ImageBase Address but a relocation table is a part of exe in case there is a conflict ...


2

I know few ways to prevent resources extraction/reading: Encrypt your resources and dinamically decrypt them in runtime without writing temp files Load the resources from the internet (require internet conntection) Corrupt the CRC32 of the resources files, this will make winzip or winrar unable to extract your resources Set \u0000 (\x0) as file name ...


1

Welcome, it's hard to guess with the information that you provided but I believe you tried very hard. Checkout https://github.com/dnSpy/dnSpy this is source code and it will help you tweak it for your needs


1

its very hard to understand what you want How to get machine code of a file(mainly executables) in C? so you want a C program that loads an executable file (for example dos,windows,linux exucutable) and showing you the whole or parts of the image (that normaly contains machine code and data)? so there are several documented file formats that can contain ...


1

from binascii import * from pefile import * from capstone import * if(sys.argv[1]): pe = PE(sys.argv[1]) entry = pe.OPTIONAL_HEADER.AddressOfEntryPoint base = pe.OPTIONAL_HEADER.ImageBase OEP = base+entry bytes = pe.get_data(entry,17) print(hexlify(bytes)) for i in (Cs(CS_ARCH_X86,CS_MODE_64).disasm(bytes,OEP)): ...


1

You can make a program that interprets machine code using an engine like Capstone-engine, this is the easiest way to do something that gives you good results in an optimized way easily, keep in mind that this is not an easy task, it is much better to use a ready-made tool, we have many free and very good options and constantly updated like Ghidra, but if you ...


Only top voted, non community-wiki answers of a minimum length are eligible