can i get the source code from the exe?

[Abanoup]

Greetings,

as the Title can i get the source code from the exe its self??

Thnx
Regards
Abanoup

[m4ster r0shi]

Yes.

http://en.wikipedia.org/wiki/Disassembler
http://en.wikipedia.org/wiki/Decompiler
http://www.ollydbg.de/

[Abanoup]

@m4ster r0shi

yah i know that but it does not show me the source code its self , its like showing me how is the exe working , i want it to show me the code like #include .......

got meh?

[m4ster r0shi]

Look at the second link I gave you.
And this -> http://boomerang.sourceforge.net/index.php

[Athar]

That's not possible. A stripped down and optimized binary does not contain any type information (other than polymorphic types), variable names or function names. So you can't get anything better than what a decompiler would give you.

[m4ster r0shi]

At least, not at the moment. But you can get a very good idea of what the source code looked like. And a very good idea of what the source code looked like is far better than no idea at all. Don't you agree?

EDIT: Check this out -> http://boomerang.sourceforge.net/cando.php?hidemenu

EDIT 2:

Athar wrote:

So you can't get anything better than what a decompiler would give you.

You mean disassembler.

[Abanoup]

ummmm its not working with exe it is crashing while am loading it but it's working with the dll files


btw am using PE Explorer/ollydbg to Disassembler and viewe the codes but i can not add new codes its also crash 0.0 , is there anyprog can i use better than those 2?

[m4ster r0shi]

Boomerang is still under development. There's a lot of work to be done. Don't expect it to work with commercial programs.

Of course you can't just add code to a binary file. You have to also modify the header where the number of segments and the size of each segment is stored. Also, if you want to add code it would be better to add it in the end of the file and move there with JMPs. That is because there probably are hardocred addresses that point to existing code and if you just add more code in the middle of the exe some of these addresses will become invalid and the program will be a junk.

An alternative that works very well is trying to find code-caves. That is parts of the existing code that do absolutely nothing. You can put your code there, JMP there, execute your code and then JMP back. This way you don't have to modify the PE header, as you don't modify the size of the binary.

[Abanoup]

is there anytut for this way?


Edit: or can u help me by ur self?

[m4ster r0shi]

Hmmm... This here might help -> http://www.programmersheaven.com/2/Inject-code-to-Portable-Executable-file

And if it doesn't, my guess is that there are plenty tutorials on this out there. Just google around a bit.

[Athar]

m4ster r0shi wrote:

You mean disassembler.

I don't.

[m4ster r0shi]

Oh, ok. I thought that you meant that a decompiler would give nothing better than a disassembler would give. I guess I somehow misunderstood what you said. Sorry about that.