Petya: “I Want to Believe”

Re:Petya: “I Want to Believe” by pjmlp on Friday June 30, 2017 @05:02AM (#14669458)

The first step is to get hold of a hexdump editor.

Then you need to have an idea of the executable file format so that you can extract information from the respective file sections.

Of course, there are tools that will extract those sections. So manual work only occurs if the tools fail to do their work.

In the case of executables, reverse engineering tools like IDA give an helping hand.

Then it goes from there, with lots of Assembly love and knowledge of OS internals.

[ Parent | on HN ]

Re:Petya: “I Want to Believe” by bitexploder on Friday June 30, 2017 @08:38AM (#14670324)

Okteta for Linux, Hex Fiend for Mac , 010 for Windows.

Radare is a free disassembler.

Hopper is good a good disassembler for Mac.

IDA is great, but very expensive.

Manual work happens almost always with weird malware and or packers. They almost always do something that makes trivial reversing harder.

[ Parent | on HN ]