« first day (530 days earlier)      last day (2858 days later) » 

10:36 AM
Hi
 
 
3 hours later…
1:59 PM
Does anyone know of a good way to determine an exe's programming language without running it?
 
@gunr2171 you mean which programming language was used to create said exe?
 
@gunr2171 afaick exes are binaries...
 
JAL
@gunr2171 i'm not a windows dev, but aren't all windows executables compiled into machine code? I'm not sure that is possible
 
how can even you know when running it?
 
JAL
this might be a longshot but you can look at the dlls linked at runtime
 
2:01 PM
the IT department here sent out a fake phishing attack email. The attachment was a zipped exe file. I'm trying to figure out how it works.
 
oh you want to disassemble it.
 
@gunr2171 step 1 virtual machine, step 2 disassemble, step 3 plop?
 
moving conversation to the testing room
 
@gunr2171 thanks for picking the rom and not the ram this time
 
2:03 PM
@gunr2171 something like this security.stackexchange.com/q/12312/27973?
 
14 messages moved from SO Close Vote Reviewers
 
So I was invited and there aren't any waffles?!
WHAT IS THIS SERVICE
 
JAL
ok let's see..
looks like most of those are windows system dlls, still investigating
 
I also have the file on a linux box, been running some tools as well
 
JAL
is rec studio 4 the tool you're using to disassemble?
 
2:05 PM
I guess?
I don't know much about disassembly/decompiling
running strings on linux, a portion of the output looks like this:
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
@JAL I mean, yes, that is the program i downloaded that I used to get that screenshot. No idea if that's going to help me.
 
Looks to be a standard C++ native binary. If you have visual studio you could open the command prompt and run dumpbin /imports on the exe to see what it's pulling in from the system.
 
(oh, sql 2016 dev worked just fine at my place, thanks)
I've got VS 2015 here with the ability to make c++ projects. Can you walk me through what i'm doing?
I don't know how to get to the command prompt that knows about dumpbin
 
In the start menu there should be a "open visual studio command prompt" somewhere
 
ok, I got the VS 2015 cmd open
ran the command
Dump of file Osram Social Network.exe

File Type: EXECUTABLE IMAGE

  Section contains the following imports:

    KERNEL32.DLL
                4BCED0 Import Address Table
                     0 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                    0 LoadLibraryA
                    0 GetProcAddress
                    0 VirtualProtect
                    0 VirtualAlloc
                    0 VirtualFree
                    0 ExitProcess
 
Given that there's no import from mscorlib it's not .net, so it's probably written in plain C/C++
 
2:18 PM
I tried opening the file in dotPeek, and that failed. so makes sense
 
If you find out who made the program, let them know it's 2016, and they really should be compiling with unicode. :)
 
I'm probably going to email them back asking for the source code
 
There's also at least one bad practice in there, they initialize COM, but they never uninitialize.
 
JAL
haha
just respond to the phishing attempt with 0/10, would not fall for, and a list of complaints
 
lol
 
2:28 PM
meh, well I'm going to stop searching for now. Need to get to other things
 
 
8 hours later…
10:53 PM
An error happened in UserTracking (cc @Sam)
0: Error getting response stream (ReadDone1): ReceiveFailure
1: EndRead failure
2: Connection reset by peer
----
at System.Net.Sockets.Socket.EndReceive (IAsyncResult result) <0x403aaf90 + 0x000a3> in <filename unknown>:0
at System.Net.Sockets.NetworkStream.EndRead (IAsyncResult ar) <0x403aae50 + 0x00057> in <filename unknown>:0

at System.Net.Sockets.NetworkStream.EndRead (IAsyncResult ar) <0x403aae50 + 0x000c7> in <filename unknown>:0
at System.Net.WebConnection.ReadDone (IAsyncResult result) <0x403d7320 + 0x00155> in <filename unknown>:0
 
2 messages moved from SO Close Vote Reviewers
 

« first day (530 days earlier)      last day (2858 days later) »