analyzing-blackbox-pe-exe

name	analyzing-blackbox-pe-exe
description	Reconstruct the logic of Windows PE executables and DLLs (.exe/.dll). Covers import-address-table analysis, Windows API capability mapping, entrypoint/WinMain discovery, decompilation, unpacking (UPX), and solving input-gated checks. Use for Windows PE/exe/dll targets.
license	Apache-2.0
metadata	{"domain":"reverse-engineering","formats":"pe, exe, dll"}

Analyzing Black-Box Windows PE / EXE

Scope

PE32/PE32+ executables and DLLs. Analysis is performed on Linux with rizin/Ghidra (no Windows execution).

Workflow

1. Triage for arch (x86/x86_64/arm64), pe_kind (exe/dll), and packing. A high-entropy section list or UPX hint means unpack first: unpack mode=upx (or mode=auto). Re-triage the unpacked file.

2. Import Address Table = capability map. symbols what=imports. Group the Windows APIs to infer behavior:

   • Network: WS2_32 (socket,connect,send), WinHTTP/WinINet (InternetOpen,HttpSendRequest), URLDownloadToFile.
   • Process/inject: CreateProcess, VirtualAlloc(Ex), WriteProcessMemory, CreateRemoteThread, LoadLibrary, GetProcAddress.
   • Persistence: RegSetValue, CreateService, Schedule.
   • Crypto: CryptAcquireContext, BCrypt*, CryptEncrypt.
   • Anti-analysis: IsDebuggerPresent, CheckRemoteDebuggerPresent, GetTickCount, Sleep, NtQueryInformationProcess. For DLLs, symbols what=exports lists the callable surface (and ordinals).

3. Strings & resources. strings_scan for C2 URLs, registry paths, mutex names, command lines, embedded scripts. PE resources/overlays can hide payloads — unpack mode=binwalk to carve, then re-triage.

4. Entrypoint → logic. decompile mode=func name=entry (or the address from triage). For GUI apps trace to WinMain; for services to ServiceMain. Then decompile mode=list and decompile the API-heavy functions found in step 2.

5. Dynamic-import / API resolution. Watch for LoadLibrary+GetProcAddress patterns (hidden imports) and stack-string / XOR-decoded API names — decompile the resolver and recover names statically.

6. Input-gated logic. Key checks, activation, or C2 auth comparisons: get the success/fail addresses from decompilation and run symexec find=<success> avoid=<fail> input=stdin|arg. (angr loads PE too.)

Report

Identity/arch/subsystem · packer & unpacking · IAT capability map · entrypoint & key functions · C2/registry/mutex strings · anti-analysis tricks · solved inputs · overall behavior summary.