Hot answers tagged

64

Unpacking a generic wrapping packer or cryptor usually involves the following steps: 1. Trace the code, possibly evading or bypassing anti-debugging checks. This is not difficult with simple packers but might be tricky with the more advanced ones. They may employ timing checks (rdtsc), exception-based control transfer, using debug registers for ...


49

ILSpy is a great open-source decompiler. ILSpy Features Assembly browsing IL Disassembly Support C# 5.0 "async" Decompilation to C# Supports lambdas and 'yield return' Shows XML documentation Decompilation to VB Saving of resources Save decompiled assembly as .csproj Search for types/methods/properties (substring) Hyperlink-...


31

extract EXE's appended data (block starting with PYZ, until the end of the file) extract wanted files with PyInstaller's archive viewer decompyle .PYCs - I personally recommend Uncompyle2 for that.


24

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


23

Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, ...


23

I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder): For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip ...


23

I've used JetBrains dotPeek (free of charge) before with some success. Any JetBrains software I've ever used has been very solid. It is not quite the 'original source' but it is very readable C# - about the closest thing I would expect to get. Quote from their website: What's Cool about dotPeek? Decompiling .NET 1.0-4.5 assemblies to C# ...


15

why is the default imagebase value 0x400000? From http://msdn.microsoft.com/en-us/library/ms809762.aspx -- In executables produced for Windows NT, the default image base is 0x10000. For DLLs, the default is 0x400000. In Windows 95, the address 0x10000 can't be used to load 32-bit EXEs because it lies within a linear address region shared by all ...


13

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


13

Igor's answer is very good. However, the outlined techniques rely on the assumption that at some point the executable is unpacked in memory. This is not always true. Virtualization obfusactors compile the original binary into a custom instruction set when is executed by an simulator at runtime. If you encounter a binary obfuscated in this way you have no ...


11

Checking DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress in the data directory portion of the PE header for a nonzero value is probably the fastest way. #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor References: IMAGE_DATA_DIRECTORY structure Anatomy of a .NET Assembly – PE Headers


11

There is a free tool available called JustDecompile which does that. Some features: Creating a Visual Studio project from an assembly in order to export lost projects or obtain multiple classes without the need to copy and paste code. At present, JustDecompile is able to export decompiled code only to C#. Exporting code directly from the command ...


11

A managed DLL / Application will have a primary dependency on MSCOREE.dll... So, if you open the DLL in Dependency Walker you have no problems in telling a managed library from an unmanaged one. http://www.dependencywalker.com/ Quoted from here and other usefull link : msdn ; msdn2


11

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders. Set SizeOfHeaders to AddressOfEntryPoint to make it work. The error you get is defined in ntstatus.h as follows: // // MessageId: STATUS_INVALID_IMAGE_FORMAT // // MessageText: // // {Bad Image} // %hs is either not designed to run on Windows or it ...


11

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four types of reasonable, useable executable file types that may not have any imports: An executable that does not require any OS APIs. This is somewhat similar to ...


10

PyInstaller publishes it's source so you see exactly how it packs the python code in the executable... A more general approach would be to use a tool like binwalk on the exe as a first step.


10

It is not that easy, or it is rather error prone. If you are going to insert 3 bytes in place of 2 bytes, you would be better off if you do a trampoline: jump to some other place, do what you want, then jump back to the next instruction. By employing trampolining, you can also save the registers. A small sample could be like this: jmp SomePlace <---...


10

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


9

This is caused by a differences in the operating system's loader and the file format parsing code in the tool you are using. Malicious program authors often exploit differences between an executable file format's specification and how the file format is actually used by the loader in practice. If there are differences between the file format specification ...


9

I have used .NET Reflector (Note: Commercial, but trial available) several times and quite like it: http://www.red-gate.com/products/dotnet-development/reflector/


9

The presentation at hack.lu 2012 titled "A Critical Analysis of Dropbox Software Security" discussed reversing of the Dropbox desktop client which used a similar implementation but with an added twist of customized Python interpreter with changed bytecode. Presentation review: http://blog.csnc.ch/2012/12/asfws-a-critical-analysis-of-dropbox-software-...


9

As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure. Import Table The Import Table is actually called "Import Directory Table" and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT) To quote from the PE ...


8

This process should get you as close to the original source as possible. Basically what tools like pyinstaller and py2exe do is package libraries and dependencies all together so you can run the 'stand-alone' EXE without having to download them or prepare the machine with a python interpreter. When you launch the EXE - it is unpackaged in memory. This ...


8

Just to clarify: the appended data - also called overlay - is the part of a PE file that is not covered by the header. Because of some tricky conditions in the PE file format, it might be difficult to determine in some extreme case, so it's better to rely on a robust library such as pefile. Here is a simple Python script that relies on pefile to extract ...


8

TL;DR you can call anything, locating the right part of code is the hard part. export table If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation. locating any function IDA If ...


8

I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal. The first step is to find the base address of the image loaded into memory. This step will be different depending on if the executable has or hasn't been mapped into memory, but the basic idea will ...


8

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical byte long will have the entire 4kb of memory allocated for it. The first section is mapped into memory after the file header, so it will be 4kb away from the ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


7

If the executable itself isn't packed or obfuscated you can often find the jar or class files by simply opening it in decompression utilty such as 7-zip.


7

You appear to be missing the corner cases such as mis-aligned pointers (should round down) and sizes (should round up). However, even the rounding has corner cases - the physical pointer should be rounded down to a multiple of 512, regardless of the value in the header, but the read size is rounded up by using a combination of the file alignment and 4kb. ...


Only top voted, non community-wiki answers of a minimum length are eligible