can you decompile a .exe?

Question

i was thinking of making an injector...i'm just curious as to if you can decompile an exe, so i can explore the code of an injector to get the feel of it. and get an idea of what i'd need. 


so can you? if so how?

ilovecookies · Answer

[quote=h4x0rswln is back;1357267]i was thinking of making an injector...i'm just curious as to if you can decompile an exe, so i can explore the code of an injector to get the feel of it. and get an idea of what i'd need. 


so can you? if so how?[/quote]

No really such a thing as a Decompiler, but there are disassemblers, which breaks .exes and .dll's down into pseudo-code and ASM, which isn't readable unless you know what you're doing. And if a program happens to be packed with Themida then you have to unpack themida before it can be disassembled other wise it will still come out all encrypted as if you tried to open it in note pad.

h4x0rswln is back · Answer

[quote=ilovecookies;1357285]No really such a thing as a Decompiler, but there are disassemblers, which breaks .exes and .dll's down into pseudo-code and ASM, which isn't readable unless you know what you're doing. And if a program happens to be packed with Themida then you have to unpack themida before it can be disassembled other wise it will still come out all encrypted as if you tried to open it in note pad.[/quote]

hm....maybe i'll just find some injector source codes.....<,<

Void · Answer

DLL injectors simply load modules into the target program using the LoadLibrary (http://msdn.microsoft.com/en-us/library/ms684175%28VS.85%29.aspx) function. You cannot just use LoadLibrary any way you want, you would have to get the procedure address of LoadLibrary using GetProcAddress (http://msdn.microsoft.com/en-us/library/ms683212%28VS.85%29.aspx) and then create a remote thread starting at the location of the LoadLibrary procedure. 

Now, the LoadLibrary function does take a parameter, in this case, the path to the DLL you're injecting. You can't just create string and use that as the parameter because the LoadLibrary function isn't being called in your program, it's being called in the target process in which has no access to any of your programs variables. You have to write the path somewhere in the processes memory using WriteProcessMemory (http://msdn.microsoft.com/en-us/library/ms681674%28VS.85%29.aspx). You can use VirtualAllocEx (http://msdn.microsoft.com/en-us/library/aa366890%28VS.85%29.aspx) to allocate memory in which you can write your path to. 

I didn't put the steps in order and I didn't include every single function but if you actualy want to learn something I suggest you read up on this. I could have just gave you some code but then again, I wouldn't want you leeching, I'd rather you have to learn it.

This was off the top of my head so if anyone sees any mistakes or if i'm missing something...just say it.

falzarex · Answer

Its possible but only with VB executables and yeah c++ doesn't go well with vb :)

why06 · Answer

[quote=Davidm44;1357326]
Now, the LoadLibrary function does take a parameter, in this case, the path to the DLL you're injecting. You can't just create string and use that as the parameter because the LoadLibrary function isn't being called in your program, it's being called in the target process in which has no access to any of your programs variables. You have to write the path somewhere in the processes memory using WriteProcessMemory (http://msdn.microsoft.com/en-us/library/ms681674%28VS.85%29.aspx). You can use VirtualAllocEx (http://msdn.microsoft.com/en-us/library/aa366890%28VS.85%29.aspx) to allocate memory in which you can write your path to. [/quote]

Very nice explanation David. You know more about this then I do so I have no idea if your right or wrong, but I think that's how the titanium injector works.

I also think there might be a way to do it by hooking or detouring... prbly wrong =/

radnomguywfq3 · Answer

[quote=Davidm44;1357326]DLL injectors simply load modules into the target program using the LoadLibrary (http://msdn.microsoft.com/en-us/library/ms684175%28VS.85%29.aspx) function. You cannot just use LoadLibrary any way you want, you would have to get the procedure address of LoadLibrary using GetProcAddress (http://msdn.microsoft.com/en-us/library/ms683212%28VS.85%29.aspx) and then create a remote thread starting at the location of the LoadLibrary procedure.

Now, the LoadLibrary function does take a parameter, in this case, the path to the DLL you're injecting. You can't just create string and use that as the parameter because the LoadLibrary function isn't being called in your program, it's being called in the target process in which has no access to any of your programs variables. You have to write the path somewhere in the processes memory using WriteProcessMemory (http://msdn.microsoft.com/en-us/library/ms681674%28VS.85%29.aspx). You can use VirtualAllocEx (http://msdn.microsoft.com/en-us/library/aa366890%28VS.85%29.aspx) to allocate memory in which you can write your path to.

I didn't put the steps in order and I didn't include every single function but if you actually want to learn something I suggest you read up on this. I could have just gave you some code but then again, I wouldn't want you leeching, I'd rather you have to learn it.

This was off the top of my head so if anyone sees any mistakes or if i'm missing something...just say it.[/quote]

Nice explanation. You're missing a couple important steps through.
1. Allocate some memory in the target process(using VirtualAllocEx). Next, it's important you make sure you have write & execute permissions to that region. So using VirtualProtectEx, give yourself sufficient permissions to the memory region.

2. At the base of the newly allocated memory region, you need to write information such as where the library that you want loaded can be located in the form of a string. And at which address the procedu

Matrix_NEO006 · Answer

very well explained jetamay

Hell_Demon · Answer

Jetamay is a god like B1ackAnge1, but he speaks less often(although I haven't seen BA in a while either).

Void · Answer

[quote=why06;1357530]Very nice explanation David. You know more about this then I do so I have no idea if your right or wrong, but I think that's how the titanium injector works.

I also think there might be a way to do it by hooking or detouring... prbly wrong =/[/quote]

Err..I'm not sure but. You can hook the LoadLibrary function and whenever it's called you can just edit it to load your own library instead of the one it actually wants to. Although...I guess you'll be missing some important libraries if you do that. I'm not too sure.

Hell_Demon · Answer

[quote=Davidm44;1359363]Err..I'm not sure but. You can hook the LoadLibrary function and whenever it's called you can just edit it to load your own library instead of the one it actually wants to. Although...I guess you'll be missing some important libraries if you do that. I'm not too sure.[/quote]

Wouldn't that require you to be in the other process already? :P

You could code cave in the exe tho(use ollydbg to jmp to your code, exec the original codes from there and then call loadlibrary, and after loadlibrary jum back)

can you decompile a .exe?

Similar Threads

Tags for this Thread