[Binrev] Automate Reversing Windows Binaries for Pentesters

- Static analysis: you can do a basic manual code review for decompiled sources to discover hidden communication channels, search for hard-coded passwords, or SQL injection vulnerabilities.
- Import decompiled projects to an IDE to reconstruct and modify the original source code
- Call hidden native exported functions with rundll32
Here is a rough description of what it does, and what tools it is using:
- For exe, dll files:
- Detect and de-obfuscate for .NET libraries with de4dot
- Decompile .NET libraries with JustDecompile
- Zip decompiled source code to netsources.zip
- Run strings against native libraries
- Export call-able functions with dllexp. You can then try to run those functions with command Rundll32 <dll>,<function name>
- Export dependencies with depends
- Extract native resources with resourcesextract
- For jar files:
- Extract and combine java classes into a single zip file
- Decompile java sources with procyon
- Zip decompiled source code to javasources.zip
[Binrev] Automate Reversing Windows Binaries for Pentesters
Reviewed by Zion3R
on
12:09 AM
Rating:
![[Binrev] Automate Reversing Windows Binaries for Pentesters](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZION9M0BQTIp0dkR8xRH9xyUVhMOzUPFWAhY9bf7bBA9ORPM8a8wmcwiBQKePUv2bKmrH-uWRAQ8LD5-Uh32N0P7LlhwH1iB3KBomgAihDIT5acKqayV64kaxDrq_8AfoCkE2ueXfYrA/s72-c/netspi.bmp)