Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
closed as off-topic by Xander, Steffen Ullrich, Rory Alsop♦ Apr 10 at 11:24
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Xander, Steffen Ullrich, Rory Alsop
Tools exist that can disassemble an executable most of the time, but it's not guaranteed. There are many techniques used by malware to resist analysis that prevent tools from providing a clear picture of what's going on, without significant manual intervention.
The first level of these are Packers which essentially create proxies for calls to obscure what procedures are doing and often encrypt data.
More advanced techniques serve to prevent analysis in tools like IDA by changing execution depending on whether it's being run in a real system or a debugger. Here's a good rundown of Packers, crypters, and anti analysis techniques.
You may want to check out the reverse engineering stack exchange.