0

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?

closed as off-topic by Xander, Steffen Ullrich, Rory Alsop Apr 10 at 11:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Besides all the reverse engineering tools? – schroeder Apr 2 at 16:15
  • When you googled “decompiler” what results did you get? – julian Apr 3 at 9:02
2

Tools exist that can disassemble an executable most of the time, but it's not guaranteed. There are many techniques used by malware to resist analysis that prevent tools from providing a clear picture of what's going on, without significant manual intervention.

The first level of these are Packers which essentially create proxies for calls to obscure what procedures are doing and often encrypt data.

More advanced techniques serve to prevent analysis in tools like IDA by changing execution depending on whether it's being run in a real system or a debugger. Here's a good rundown of Packers, crypters, and anti analysis techniques.

You may want to check out the reverse engineering stack exchange.

  • 1
    Packing refers to executable compression – julian Apr 3 at 8:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.