So continuing from our previous video will cover a quick demo about how we can compile source code to 1
generate an executable. 2
So here we'll be taking an example of C C++ based source code and then we're going to we'll be going 3
through the same step which we talked about like it will first go to a compiler. 4
It will generate the object file from there. 5
It would go to a linker which will include all the header files and from there it will finally generate 6
the executable or the exe file. Once the file is generated, 7
We can obviously run it and if you remember the beginning few videos of this module, we talked about 8
how actually an operating system loads and executable into the memory. 9
So in this way we'll be able to connect that entire process together about how we start writing the 10
code how we compile it how we generate a file executable and what happens when the operating system 11
runs that executable. 12
So once this entire loop is clear that's when we'll start jumping on to the actual reverse engineer 13
problem. 14
So if you remember in the previous video we mentioned about assembly code being getting generated out 15
of the compiler. 16
So if you look at the usual engineering process it follows from source code to the compilation of code 17
to the generation of executable file. 18
Now when you talk about reverse engineering you basically go in the other direction when you're looking 19
at a malware sample you're actually looking at an executable file. 20
You don't have the object file or you don't have the source code file. 21
So what do we do. 22
We use tools like decompilers. 23
So just notice the term decompilers. it's actually the reverse of the compilation process. 24
So it picks up an executable file and it convert it into a low level understandable format like assembly 25
so that you can understand what operations would that executable do so this was the reason why I went 26
through this entire cycle because you know if you look at an exe straight away you also have 27
to understand where that came from. 28
What was the process behind it and why spend so much time in understanding those things when you know 29
you can just look at the behavior and say that OK these are the things that the malware is doing. 30
The whole challenge is that an EXE is basically a final compiled file so you cannot 31
look at the exact source code from which it was generated. 32
You can do it in certain cases where defined decompilers are available for example .Net but not with 33
other file formats or not with other programming languages in which the EXE was compiled and generated. 34
So that's the whole reason for creating all these initial few videos to really help you understand the 35
meaning of reverse engineering why exactly is this term called reverse engineering. 36
That is because we are not working on the just the code itself. We also work on the final 37
outputs and we pick it up and we start tracing it back we start tracing it back to its origins to see 38
what exactly was the purpose of creating this file. 39
That's the whole idea about the reverse engineering piece of malware analysis so let's move to a demo 40
here. 41
I'm using an example file called 42
Hello.c. So I will also include this example file in the course resource section so you can download 43
it and you can test these on your own as well. 44
Now I will be using the standard GCC compiler which is used for compiling C++ plus programs. 45
You can easily download it from the internet. 46
I can provide you the link in the resource section as well. 47
So once you have downloaded the compiler you have to make sure that the path is defined as well. 48
So once you have defined the path Gcc would be recognized as a command-line operation so we can give 49
the command GCC -s hello.c. So -s tells me to generate the assembly 50
code of the file. 51
So if you see here a new file called Hello.s has been created. Let's look at the content of Hello.s 52
now 53
so that's how the file would look like 54
you can see here. 55
It tells me that the original compile file was hello.c. The main function. 56
Then if you start looking here there are a bunch of assembly instructions. 57
So we'll be going through in much more detail as to what those assembly instructions actually mean. 58
But this was just an demonstration to show you how we can generate the assembly if we have the source 59
code so we can just combine that code to generate the assembly file. 60
So now if you want to generate a final executable by using your source code file, all you have to do is 61
use gcc -0 and then give a name to the executable let's say hello 62
And then the name of your source code file which is Hello.c. 63
When you run it, GCC will compile it and generate an EXE file for you. 64
So this is our EXE file. 65
Now when you run the file you get the output as Hello World. 66
So that's what the program was designed to do. 67
So if you look at. 68
So if you look at the program 69
you'll see that it's a pretty straightforward standard program which includes stdio.h, then define 70
some main function and then uses printf to print Hello World onto your screen and then return 0. 71
So that's how we converted a source code into an executable. 72
Now when you are doing the malware analysis it will be the other way around. 73
It's easy to understand how exactly or what actions a source code is doing but you cannot really look 74
at any EXE file and say that without even running it 75
You cannot say that what actions it is doing so if you look at the content of a PE file, you won't see much 76
inside like it's all random and it will basically point you to file's parsing information, things 77
that we had looked out in the previous videos. 78
So this was a quick demonstration to help you really understand about the process of compilation. 79
Now we have covered a lot of ground on how exactly programs are created and how exactly they are compiled 80
and how operating systems load them into the memory. 81
We have this background built up so we can start focusing on the reverse engineering process where we would 82
start compiling executable files to understand what operations they are doing on the system. 83
Thanks for watching this video.