Author Topic: Decompilation - why we need this?  (Read 1656 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33913
  • malware fighter
Decompilation - why we need this?
« on: April 27, 2010, 08:53:54 PM »
Hi malware fighters,

Good for analysis, decompilation is the reverse of what one does with compilers.
Used for locating malicious code and comprehending malcode programs.
The absence of the full source info is the main problem here
and then obfuscation is the main hindrance to decompilation:
http://en.csharp-online.net/CSharp_FAQ:_How_protect_my_code_against_decompilation

Introduction to this subject:
http://www.program-transformation.org/Transform/DeCompilation
But incomplete without this info:
http://www.hexblog.com/decompilation/
Loads of free tools for ye all: http://www.thefreecountry.com/programming/disassemblers.shtml
good hex viewer: http://sourceforge.net/projects/hexplorer/
enjoy my friends,

pol

P.S. Nice successful example of hex analysis: http://hexblog.com/2010/01/hexrays_against_aurora.html#more
« Last Edit: April 27, 2010, 09:37:48 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!