Hot answers tagged

62

Unpacking a generic wrapping packer or cryptor usually involves the following steps: 1. Trace the code, possibly evading or bypassing anti-debugging checks. This is not difficult with simple packers but might be tricky with the more advanced ones. They may employ timing checks (rdtsc), exception-based control transfer, using debug registers for ...


49

ILSpy is a great open-source decompiler. ILSpy Features Assembly browsing IL Disassembly Support C# 5.0 "async" Decompilation to C# Supports lambdas and 'yield return' Shows XML documentation Decompilation to VB Saving of resources Save decompiled assembly as .csproj Search for types/methods/properties (substring) Hyperlink-...


26

extract EXE's appended data (block starting with PYZ, until the end of the file) extract wanted files with PyInstaller's archive viewer decompyle .PYCs - I personally recommend Uncompyle2 for that.


23

I've used JetBrains dotPeek (free of charge) before with some success. Any JetBrains software I've ever used has been very solid. It is not quite the 'original source' but it is very readable C# - about the closest thing I would expect to get. Quote from their website: What's Cool about dotPeek? Decompiling .NET 1.0-4.5 assemblies to C# ...


22

Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, ...


22

I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder): For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip ...


22

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


15

why is the default imagebase value 0x400000? From http://msdn.microsoft.com/en-us/library/ms809762.aspx -- In executables produced for Windows NT, the default image base is 0x10000. For DLLs, the default is 0x400000. In Windows 95, the address 0x10000 can't be used to load 32-bit EXEs because it lies within a linear address region shared by all ...


13

Igor's answer is very good. However, the outlined techniques rely on the assumption that at some point the executable is unpacked in memory. This is not always true. Virtualization obfusactors compile the original binary into a custom instruction set when is executed by an simulator at runtime. If you encounter a binary obfuscated in this way you have no ...


11

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


11

There is a free tool available called JustDecompile which does that. Some features: Creating a Visual Studio project from an assembly in order to export lost projects or obtain multiple classes without the need to copy and paste code. At present, JustDecompile is able to export decompiled code only to C#. Exporting code directly from the command ...


11

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders. Set SizeOfHeaders to AddressOfEntryPoint to make it work. The error you get is defined in ntstatus.h as follows: // // MessageId: STATUS_INVALID_IMAGE_FORMAT // // MessageText: // // {Bad Image} // %hs is either not designed to run on Windows or it ...


11

Although blabb's answer shows an executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level. I can think of four types of reasonable, useable executable file types that may not have any imports: An executable that does not require any OS APIs. This is somewhat similar to ...


10

A managed DLL / Application will have a primary dependency on MSCOREE.dll... So, if you open the DLL in Dependency Walker you have no problems in telling a managed library from an unmanaged one. http://www.dependencywalker.com/ Quoted from here and other usefull link : msdn ; msdn2


10

PyInstaller publishes it's source so you see exactly how it packs the python code in the executable... A more general approach would be to use a tool like binwalk on the exe as a first step.


10

Checking DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress in the data directory portion of the PE header for a nonzero value is probably the fastest way. #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor References: IMAGE_DATA_DIRECTORY structure Anatomy of a .NET Assembly – PE Headers


10

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


9

This is caused by a differences in the operating system's loader and the file format parsing code in the tool you are using. Malicious program authors often exploit differences between an executable file format's specification and how the file format is actually used by the loader in practice. If there are differences between the file format specification ...


9

I have used .NET Reflector (Note: Commercial, but trial available) several times and quite like it: http://www.red-gate.com/products/dotnet-development/reflector/


9

The presentation at hack.lu 2012 titled "A Critical Analysis of Dropbox Software Security" discussed reversing of the Dropbox desktop client which used a similar implementation but with an added twist of customized Python interpreter with changed bytecode. Presentation review: http://blog.csnc.ch/2012/12/asfws-a-critical-analysis-of-dropbox-software-...


8

This process should get you as close to the original source as possible. Basically what tools like pyinstaller and py2exe do is package libraries and dependencies all together so you can run the 'stand-alone' EXE without having to download them or prepare the machine with a python interpreter. When you launch the EXE - it is unpackaged in memory. This ...


8

TL;DR you can call anything, locating the right part of code is the hard part. export table If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation. locating any function IDA ...


8

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical byte long will have the entire 4kb of memory allocated for it. The first section is mapped into memory after the file header, so it will be 4kb away from the ...


8

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions: call $+5 pop eax This works because call will push the next address (where pop eax ...


7

Just to clarify: the appended data - also called overlay - is the part of a PE file that is not covered by the header. Because of some tricky conditions in the PE file format, it might be difficult to determine in some extreme case, so it's better to rely on a robust library such as pefile. Here is a simple Python script that relies on pefile to extract ...


7

It is not that easy or it is rather error prone if you are going to insert 3 bytes in place of 2 bytes you would be better off if you do a trampoline (jump to some other place do what you want jump back to next instruction by employing trampolining you can also save the registers a small sample could be like `jmp SomePlace` <---destroy old bytes and ...


7

You appear to be missing the corner cases such as mis-aligned pointers (should round down) and sizes (should round up). However, even the rounding has corner cases - the physical pointer should be rounded down to a multiple of 512, regardless of the value in the header, but the read size is rounded up by using a combination of the file alignment and 4kb. ...


7

NX: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT != 0 ASLR: IMAGE_OPTIONAL_HEADER.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE != 0 SAFESEH: (IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress != 0) && (IMAGE_OPTIONAL_HEADER.DataDirectory[...


6

If the executable itself isn't packed or obfuscated you can often find the jar or class files by simply opening it in decompression utilty such as 7-zip.


6

disasm use IDA (why olly only? IDA free might do the trick), or OllyDbg with BeaEngine plug-in (it has some specific ASM syntax options) improve in the disassembler rename as many labels as possible, using delta address - it's painful to do that later export to ASM rework the ASM syntax to get it re-assemblable patch either: make your ASM code EIP-...


Only top voted, non community-wiki answers of a minimum length are eligible