# Reverse Engineering Simple Windows Executable Files

**1. Overview of the Session:**

* **Objective:** Demonstrate how to reverse engineer simple Windows executable files.
* **Files to Analyze: (say)**
  * **C-Sharp Compiled Program:** `re_test_Desktopapp1.exe`
  * **Native Executable File:** `re_lotsastuff.exe`
* **Tools and Setup:**
  * Restored Windows VM image.
  * FakeNet tool running to intercept outgoing network traffic.
  * Course files copied into the VM.

**2. Analysis of C-Sharp Compiled Program:**

* **File Identification:**
  * Used **Detect It Easy** to identify the file type.
  * `re_test_Desktopapp1.exe` identified as a PE32 file compiled from a .NET source.
* **Decompilation with dnSpy:**
  * **dnSpy:** A .NET decompiler tool used to show the equivalent source in C#.
  * **Process:**
    1. Drag and drop the sample into the dnSpy console to begin decompilation.
    2. Navigate to the function or method indicated at the entry point.
* **Code Analysis:**
  * The code performs the following:
    1. Displays a message box with the text "for educational purposes only".
    2. Attempts to open a webpage from `phishing.website.com`.
    3. Runs CMD, which opens a command prompt.
* **Using MSDN References:** Helpful in understanding the behavior of the code, particularly the functions and methods used.

**3. Debugging the Program:**

* **Setting Breakpoints:**
  * Set a breakpoint at the first line of code where the text variable is set ("for educational purposes only").
  * Use **F9** to set the breakpoint.
* **Starting Debugging:**
  * Press **F5** to start debugging.
  * Use **F10** to step over or **F11** to step into the code.
* **Observations During Debugging:**
  * The program displays the message box as expected.
  * Encountered an issue with the `open read` function that attempts to read contents from `phishing.website.com/dotnet`.
  * The function fails, possibly due to coding issues. It's advisable to note this behavior and revisit it later with more information.
  * The final observed behavior is the execution of CMD.

**4. Key Takeaways:**

* **C-Sharp Language Knowledge:** Understanding C# syntax is beneficial when analyzing .NET programs to grasp malware behavior better.
* **Breakpoint Usage:** Setting breakpoints at crucial points (e.g., entry points) helps in observing program behavior systematically.
* **Documentation Practice:** It's good practice to document all behaviors and potential issues encountered during analysis for further investigation.

**5. Transition to Native Executable Analysis:**

* After analyzing the C-Sharp compiled program, the next step is to move on to analyzing the native executable file `re_lotsastuff.exe`.