I tryed with dnspy but didn't work
I tried with python decomposer but didn't work
Any suggest?Ida pro?ghidra?
If you have trouble using dnSpy and the Python decoder and want to analyze programs (especially Windows executable .exe files), IDA Pro and Ghidra are very powerful tools that can help you disassemble and reverse engineer. Here are their usage suggestions and how to optimize these tools:
1. Reverse Engineering with Ghidra
Ghidra is a free and open source reverse engineering tool released by the National Security Agency (NSA). It is powerful and supports multiple platforms and architectures (Windows, Linux, macOS). It can help you analyze .exe files and disassemble them through reverse engineering.
How to use Ghidra for reverse analysis
Download and install Ghidra: Ghidra official download link
Open Ghidra and create a new project (New Project).
Select your target .exe file and import it into the project.
Ghidra will automatically analyze the file, and you can select Auto Analyze to help you automatically mark functions and code blocks.
You can view the disassembled code and follow different program paths, or use the Decompiler function to convert the assembly into more understandable C code.
2. Reverse Engineering with IDA Pro
IDA Pro is a very powerful disassembly tool that is widely used for reverse engineering analysis of software, especially for the analysis of Windows executable files. Although IDA Pro is a paid tool, its free version (IDA Free) also provides many powerful features.
How to use IDA Pro for analysis
Download and install IDA Pro (the free version is suitable for small programs): IDA Pro download link
Open IDA Pro and select File -> Open to open your .exe file.
IDA will automatically disassemble the program and generate a graphical function and flow view based on its instructions.
You can analyze the disassembly results and use Pseudocode to view the effect of disassembly as pseudocode to facilitate understanding of program logic.
3. Use other tools to supplement the analysis
In addition to Ghidra and IDA Pro, you can also use the following tools for analysis:
OllyDbg
OllyDbg is a free 32-bit disassembler debugger suitable for dynamic analysis and debugging. It is very useful for malware analysis.
Download: OllyDbg
x64dbg
x64dbg is an open source debugging tool that supports 32-bit and 64-bit applications and is suitable for dynamic debugging and reverse engineering.
Download: x64dbg
Radare2
Radare2 is a powerful open source reverse engineering framework that supports multiple architectures and has similar functions to Ghidra and IDA Pro.
Download: Radare2
4. Solve common problems
Not enough information: If the program is packed or uses obfuscation, you may need to unpack it first. Try using PEiD or UPX to identify and unpack it.
Breakpoint problem: If the program has anti-debugging measures, the tool may be affected by the anti-debugging protection. Try to disable the anti-debugging function or use the anti-debugging plugin in OllyDbg to bypass it.
Summary
Ghidra and IDA Pro are powerful disassembly and reverse engineering tools suitable for different needs.
If the program has a packer or anti-debugging mechanism, try to unpack it or bypass the protection first.
You can combine different tools to get more information, such as OllyDbg, Radare2, etc.
If you encounter specific problems or have any progress, you can share it and I can help you analyze it further!
