binary data

i was looking at code for a program and was wondering if there is anyway for me to understand the binary data that i was seeing, u know, the stuff with all the funky characters and such...

Sure, get a hex-editor.

what do you mean the 'code'? do you mean you opened the compiled binary in a text editor? in that case, you're just seeing garbage... try a hex editor, which won't help much anyway, with the exception of finding the odd literal char array in the program...

i mean some fool sent me a keylogger... i turned the file from a .exe to a .txt so i could view it in notepad. im talkin bout all the junk like ^$%$^%%#%% as code, and such. I want to find that fool's email address in it so i can kno where its sending stuff. where can i find this "hex-editor"?

Unless you know the format the person used to create the binary data it is very difficult to discern its meaning. It is like the different picture formats they all display an image but the binary data is arranged differently.

If you are talking programs and not data files then it is a little different.

If you know that it is executable code then you can use a disassembler to view the assembly language instructions. Usually it will display the computer op codes and their numonics. The op codes are dipslayed as hex. Those are the numbers you see in the hex editor. Since these values may or may not be part of the ascii code you can get some funcky symbols displayed or nothing at all displayed.

memory address numonic op code
0000:0000 ADD AX,BX 01D8

If you really want to know what goes on with each assembly instruction I would suggest going to

http://developer.intel.com/design/pe...als/253665.htm

If you use a hex editor, you should be able to find the string table, which would most likely have their e-mail address, unless (s)he encrypted it.

Quote:

---

Originally posted by sycorax
i mean some fool sent me a keylogger... i turned the file from a .exe to a .txt so i could view it in notepad. im talkin bout all the junk like ^$%$^%%#%% as code, and such. I want to find that fool's email address in it so i can kno where its sending stuff. where can i find this "hex-editor"?

---

can you be sure it's sending emails?

yea, my firewall blocks it... apparently it was aimed at a MMORPG that i play called runescape because various items in the game are missing, and i was left with a message saying "MUAHA YOU HAVE AN INSTANT PASSWORD STEALER" instant my booty, i know its a keylogger because zonealarm catches it tryint to send emails, i just want to know where to

If you'd like to upload the program as an attachment, I'll be glad to take a look at it.

ive been told not to by some mod. i posted the code on here in a different forum, which he deleted, he said it might be something called malware, i dont know what that means, and i dont want to post it again if i will get banned for it, this community owns so i dont wanna loose it

OK, then email it to me:

[email protected]

ok, thanks for looking at it... i put the code into 2 parts just cuz i was paraniod and didnt want the keylogger doing anything again

Like everything in the computer, an exe file is stored as binary "numbers" or "bit-patterns".

These bit-patterns represent machine code instuctions (and data) that the microprocessor understands. Different microprocessors have different instruction sets. You can't run an exe from your PC, on your Mac.

Since the computer can only handle binary numbers, text is stored in ASCII code. An upper case "A" is stored as the number 65 (Decimal), or 41 Hex. The program has to keep track of this "number" to know if it's a number, an A, or a machine-code instruction. Notepad doesn't know what the numbers represent, and tries to convert everything to text.

When you compile a program, you convert the C++ source code into machine language. This process is essentially irreversable. You can't de-compile and get your original C++ code. Some data is simply lost when you compile. For example, comments don't exist in machine code, and machine code doesn't use variable names. You can get a decompiler, but it won't recreate the original code.

Assembly language is a direct line-to-line human readable representation of machine code. You can disassemble (like decompiling) a machine code program into assembly language. and you can see exactly what the program is doing. (Of course you don't get comments, etc.) I assume Sebastiani is going to look at your assembly code. For most of us mortals, understanding an uncommented assembly program more than a couple-hundred lines long is impossible. Understanding a complex program (like a game or word processing program) is just about impossible for anyone!

A hex editor allows you to look at binary data. It's easy (for humans) to convert between hex and binary, and hex is much easier to read than binary. Most hex editors will also display the corresponding ASCII character for each byte.

Malware = malicious software (virus, etc.)

ah, thanks... that clears alot up... just waiting for a reply on what if he can find the email address

can anyone give me a link to find a decompiler ? i 've googled it in a bunch of differenet ways and still cant find one

Keep searching and digging.... I got 14000 google hits for C++ decompiler!

Here's are a commercial decompiler ($1100): Salamander. It looks like you can get a tiral version (or maybe submit trial code over the net).

I found something at The University of Queensland.

There is an article at planet-source-code.com.

You might try searching some hacker sites too.

[EDIT]-
Oops! JungleCreatures is a C# decompiler. :o

http://www.program-transformation.or...ionDisassembly

edit

Just a side note if you have windows 9x you can use debug.exe to poke around.