Question

I'm doing an experiment related to my PhD research. I need to know for sure whether the .exe files located in Windows/system/ directory (such as cmd.exe, notepad.exe, etc) are all non-obfuscated or they have some kind of obfuscation or protection against reverse engineering.

Was it helpful?

Solution

Most microsoft system binaries remove RTTI and strip symbols. You can download debug symbols for lots of the public/supported libraries/functions, for actual binary analysis I would recommend IDA and the MSVC class information loader plugin.

OTHER TIPS

Reverse engineering a binary file has been discussed on the link below: What's the best practice to reverse engineering a binary file in windows?

You can't say 100% surely that any windows system file is protected against reverse engineering until anyone tried to do it. Anyhow Windows (or any OS) will provide max protection for their system files. This link can help you to guide what type of protection provided by Windows for system files. Description of the Windows File Protection feature

There are many tools/dissemblers/protocols available that can helps to inject piece of code or crack or do act of reverse engineering. I would conclude yes, windows provide protection but anyone can drill if not today, maybe in future.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top