understandin code of .exe files

Hi,
I want to be able to understand what an .exe files does,and i want to learn to edit them if needed.Does anyone here have any resources about this they'd like to share?

http://www.webopedia.com/TERM/E/executable_file.html

If you want to edit a program... Best way is to get the source, edit the source, and compile it. If you don't have the source, you SOL, unless you disassemble it or decompile it... I'm not sure which. Isn't practical with large programs.

hey there little cracker..

there are more a couple of possibilities

1. my old favorite the hex editor (just download a free one)
2. resourcehacker (editing the dialogs, strings and bitmaps in windows executables)
3. a decompiler..

A hex editor displays the contents of a file in hex format (0,1,2,3 etc to F) allong with the normal (ascii) format and lets you edit the file that way.. nothing more..
Resourcehacker will allow you to mangle windows apps and make your own little adjustments to the look and feel..
A decompiler can convert the executable back to a disassembled state, this is in no way nice readable sourcecode, but you could edit the disassambled remains and re-assamble them..

well that was all the help for now..

Could you on your part enlighten the board on your intentions with the ability to edit exe's?

An .exe file is an executable file. It is a binary file.

It is a file that has already been compiled.

If you were to examine its contents with a hex editor or notepad or whatever, you'll get a lot of junk. However, if you search for strings... you can get an idea of what it does.

There are decompilers that will attempt to give you the source code that the binary was compiled from. If you read the EULA... decompiling and the like is not permitted. reverse engineering... does that stop most people? No...

What exactly are you trying to do?

EDIT: Damn, you two beat me to it. ;)

a) Learn to program in C/C++ until you are able to dream in C/C++.
b) Learn assembly until you are able to dream in assembly.

Then you can read Hacker Disassembling Uncovered.

Looking at compiled stuff can be done in a number of way's


1. Try using a hexeditor:
only adviseble if you have detailed information about certain routines
and refferals stuff like that.
I have used HexWorkshop to edit the exe file of the game Diablo 1
at that time it was the only way to mod a number of things like spell, items and stuff like that because it was all hardcoded into the .exe and I needed to change things fast. Hexworkshop is really good.


2. Disassble and use a debug program:
This can tell you anything you want to know about a program but the more you want to
know and edit the more knolidge about assembler youl need. After i learned a bit of
assmbler it was a lot easyer to change things in diablo 1. Also this is what most crackers use
if they wan't to disable things like cd-rom cheking in games and stuff like that. You can do things like look up what dialogs are being used what strings are being accessed what reg-key's are changed stuff like that. I would like to suggest ollydbg http://home.t-online.de/home/Ollydbg/ or you can use win32dasm.



3. And the illustrius Decompile
This is the act of taking binaries and truning it back into a source. I never used this and can't tell you much about it but i suggest this tutorial http://www.crackingislife.com/tut/decompile.htm.

[EDIT]
Wait this post is full of stuff that will learn you how to crack hidding it.

Speaking of witch
if all you want to do is crack stuff go here http://biw.rult.at/index.php?page=tuts and leave antionline alone

dos debugs a useful tool to muck about with,

GDB on linux is good

Try writing a hello world program in C, then open it as a binary and get the x86 opcodes and try and convert it to ASM, using just the opcodes. Its an interesting and very time consuming exercise, but gives a good understanding of the process.

i2c

my intentions are nothing malicious here...i just want to be able to understand exe files and edit them..just to increase my computer security knowlegde..for example,if i notice a mysterious file in my computer i could analyze its exe file code to somehow understand what it does.
Anyway..thanks for all of your replies.Do you have any links to some tutorials about this topic that you'd like to share?

IDA Pro anybody. I was reading a paper on how to use IDA to turn dissassembled ASM (w/opcodes) into psuedo C/C++ code. Time consuming to say the le ast, but much fun and highly rewarding if done correctly (waste 100+ hours to get it wrong lol).

-Cheers-

Yup IDA pro is a great tool for disassembling stuff..

I have had the pleasure of playing with it on a number of occasions..
and I have to say, these guys sure made one hell of an app (well suite realy) !!

IDA pro, is a very good tool. Theres a trial version that only disassembles x86 instruction sets, but i think thats all you need. I think im right in saying that..

I want to get the full blown version so i can disassemble ARM processor types, although there are other disassembles IDA is by far the nicest to use.

i2c

Ali,

The answer is "NO"................... you obviously do not appreciate what is involved.

Also, why do you want to "edit" an executable (incidentally, there are far more than .exe files)?, particularly if you suspect that it is malware. As already pointed out, if it isn't malware, it belongs to someone else..............so leave it alone. It is NOT your intellectual property...............if you make adjustments and it doesnt work, it still has the original authors name on it?

If you are that clever................write the source yourself, then you can do what you like, and it might even work because you would understand what it does, and why?

Anyway, this is what you face with an executable object file (as opposed to source):

1. Decompress..............so what is it? self executing zip, UPX..?????????????
2. Decrypt.................bound to be encrypted isn't it.............what algorithm, XOR......?

I guess that is the point at which you will fail miserably :(

3. Oh! you got this far...........well now that you have the raw object code you need to disassemble it.

4. OH dear..........what language is that............do I know how to format the statements? do I have a compiler? Or should I apply for the job of sub-editor on a Thai language Bangkok newspaper?

I am beside myself with curiosity as to why you wish to edit an executable from its compiled code? You have NOT supplied a satisfactory explanation of that.

Well, those are my thoughts............you will never be able to do it untill you really understand what is involved.

Good luck, an DO go and learn a programming language thoroughly............they are like human foreign languages, once you have done the first others are much easier as you will have developed your personal learning style, and developing that style is vitally important.

After reading your post I thought of something.

When i modded part's of the diablo .exe was that illegal ?

Because then i violated the law eeuh (insert large number here) times.

And thanks the rest for hinting me on IDA pro, this beats Ollydbg anytime.

All this talk about disassbling makes me long back to those long night I
spend yust because that one thing I wanted to add to my mod (wich never saw version 1.0).
Wait I know i still have it around somewhere *gets lost searching through cd's*

*gives up*
Does anyone here have any experience with decompiling stuff, is it really worth the headaches it gives me when I try or not ?

[edit]

nihil after reading your post I thought you were going a bit to rough on the kid. So I reread the enire thread and conclude that you are right.

Dissasebling is a long tedius and boring bit of work, don't start yust because you wan't to learn how a 'malicous' piece of software works because you are interestid.
I have been doing this for a bit of time, and believe me it's only fun if you get some results of some kind.

And why do you wan't to know how 'malicous' software works. Yust get rid of it.