How do you see whats inside an exe?

[StumpedTechy]

I have a couple of exes here that I am supposed to install what I want to know is how to look inside the exe to see what it contains before running it? I know you can do a system comparison when you do a snapshot before running the exe then a snapshot after but I can't install this exe as its for a 2000 machine and I am on an XP Pro.

Any help with seeing what changes an exe will make without running it would be appreciated.

 

[Pleonasm]

If the EXE file is in a self-extracting format, then WinZip may be one tool that will allow you to view the individual files contained within it.

 

[smah]

This is a handy tool for monitoring changes.

 

[Frank4d]

I use a program "Resthief"

http://users.pandora.be/liontech/Downloads.htm

to extract files within an EXE. When you drag and drop an EXE onto the Resthief window, it creates a new folder (within the sane folder Resthief is running from). The new folder contains the files that are in the EXE.

 

[StumpedTechy]

Pleonasm,

sorry its not self extracting. I had tried that prior but got no results. I also am hoping for anything tat could potentially be used for msi's and other items as well. Alot of items I deal with are on other OS versions I don't readily have access to.

smah,

Sorry but that tool looks like you have to try and run the exe and this patch is for a different OS than I am running on.

Frank4d,

Thanks that works wonderes but doesn't pull out the information I need. It just rips out the icons and bin is there some way to see whats in the bin? I also noticed it only works on some exes but not others do you know why? It does not work with MSI's at all so I am kinda bummed there as well.

Keep ideas coming there has to be some tool out there that does what I need.

 

[PRPhx]

Are you talking about an installation package or the actual executable program file?????

If you are talking about the actual executable file, then there is really no way to know what is in the file. You may be able to view ASCII strings, but not much else. This is due to the fact that an executable file was run thru a build process which (in part) creates a file that is NOT human readable, but is readable by the computer.

 

[Sympology]

Exe's are designed not to be read. Could you imagine if you could grab an exe file for the latest software and see exactly what code is in it?

You best be is to get a piece of software that registers changes (see above posts). Try it on a test machine and see what happens.
I'm guessing this is a bit of freeware / shareware and you want to see if it's legit.
You could always <insert search engine here> it and see if there are any red flags up. We often use freeware / shreware and tend to see if it's got flagged up elsewhere first.

Just type the name of the exe and see what happens

Only the truly stupid believe they know everything.
Stu.. 2004

 

[StumpedTechy]

I am not asking to get code, and I am not asking to actually read what is inside a file. I am asking to get a list of modified files without installing the program.

E.G. I have to install a program on W2k machine. I don't have access to said windows XP machine but if I was there it would install imadecomputerchanges.dll, runme.exe, and 3 registry entries.

I am looking for something that would tell me WHAT the install will modify without it actually being installed.

Something like InCtrl5 but does not require you to actually install said program. Because I am using an Alt OS this isn't possible.

 

[phillid2]

Perhaps you want to install a virtual machine that you can use to install the application, see what it does and what it modifies. Since it is a virtual machine, it should not break the computer itself, just the virtual session.

Don Phillips

http://worthingtonengineering.com

 

[PRPhx]

How is the program packaged? Is it a zip file, a cab file, etc??? If it's one of those 9or other compressed file), you might be able to 'open' the file and get a list of files. With a little luck there may be a file list, or a change log indicating what files have been added, fixed, etc.

As to knowing what registry entries are added, that is probably not possible, as those additions, changes are in the exe code itself, and are made when the application is installed.

As phillid2 suggested, you may want to install a virtual machine (i.e. the one from MS, I forget it's name off the top of my head, vmware, or virtualbox, etc). Install XP if you can, then your application. With some more luck, the application may generate a log file detailing changes made.

 

[barny2006]

to see what the program does you can use debug to read instructions (in assembler, of course). it will show what the program is doing. you have to know assembler language to make sense out of it.

 

[jrbarnett]

Run your program with Process Monitor from Sysinternals on to see what happens (

http://www.microsoft.com/technet/sysinternals/default.mspx)

Dependency walker (

http://www.dependencywalker.com/)

is a useful tool for seeing which OCX's, DLLs and other files a specific program uses, but it won't report actual use while the application is running.

John

 

[StumpedTechy]

phillid2,

Thanks for that thought. I had thought about it too but our environmnet doesn't allow for me to use a virtual machine (or even a secondary computer for that matter). I Am almost ready to take this home and do it there but I don't want to give in to not taking my work home with me.

PRPhx,

The current one is an EXE but I will be getting other programs in the future e.g msi and whatnot. The problem we have is I get this software with no knowledge as to what it installs/overwrites and we run 3 different OS platforms here. I just would like a better understanding of the items I install as usually I then have to start scripting items to patch/modify things later.

barny2006,

Have any good places to start? I don't mind learning I just think its insane there isn't something easy enough you can open a program, import the exe to be scanned, and have it spit out all the pc changes it would make if ran without having to actually install the file.

jrbarnett,

Aren't both of those items that require you to actually instlal the item first? I'll look them over again but I thought those both applied to something already installed.


In all thanks guys I am seeing this "wish" of mine isn't as easy as I had first thought. Maybe i have to rethink my approach on this thing but If anyone hs ideas I sstill greatly apprciate them.

 

[AccessGuruCarl]

Just a thought....

Who's supplying these files?
And why not request documentation from the programmer.

I supply a list of all files 'created' or installed for every app I deploy, along with an un-install log and/or a .exe file to remove the app and files/changes created.

Apps that usually require activation and registration store other files, that most programmers won't list in thier log files, or be un-installed if the user removes it. But these should have no effect on the PC.

I'd would request documentation.
Especially if these are 'patch/fix' files.
I look at it as, If theres no documentation the app was poorly written and most likely not tested thoroughly.

Good Luck....

AccessGuruCarl
Programmers helping programmers
you can't find a better site.

 

[Freestone]

I think you are overlooking the fact that even if you know what the install EXE, MSI or whatever will do when invoked, you are not going to see what the installed program does after its run once, twice, etc. A program can and usually does modify registry entries, folder structures, add files, delete files, etc during its initial run. You would never be able to glean this type of information from the install file, no matter how good you get at decompiling (which, by the way, violates most License Agreements which we all read, right?). Not only would you have to decompile the install program, but also the installed program(s) themselves.

I see you mentioned InCtrl5, a favorite tool of mine. I'm sure you've used it many times to monitor a program's installation and see what changes have been made, but have you ever run it again when RUNNING the installed program the first few times? If not, you will surely be surprised to see how more things have been changed.

 

[jrbarnett]

Install it inside a VM and record a snapshot record.

John

 

[StumpedTechy]

I supply a list of all files 'created' or installed for every app I deploy, along with an un-install log and/or a .exe file to remove the app and files/changes created.

Carl your one of the few "good men" of developing. I find it harder than getup to get any information from developers to find out their "secret formula. I usually have to relate to other progams to glean what the programmer has done.

As far as documentation I know I can't get it I am about 5 leveles removed from the department that supplies it and my voice dies at about 2 levels up.

You would never be able to glean this type of information from the install file, no matter how good you get at decompiling (which, by the way, violates most License Agreements which we all read, right?).

So any ideas I had are dashed... Oh well.

[QUOTEInstall it inside a VM and record a snapshot record.[/QUOTE]

If you had read above this isn't an option for me.

Oh well I will let this question die but IMHO I think they should develop an easy way to have programs show the changes a install will make on the machine BEFORE it installs.

 

[AccessGuruCarl]

Sorry to say Stumpy...

But if you can't get documentation, and VM machine is not an option. You only have the option of trial and error!

Not even decompiling the code will make sense. It still basically is in machine language(numbers and letters) - Assembly Language that won't make any sense to the normal user.

I've disassembled a few of my own programs just to try and follow what was going on, and it is quite difficult without knowing where to put breaks to test for variables. Even with my own code! But I'm not much for assembly language, some guys eat this stuff up.

Good Luck....

AccessGuruCarl
Programmers helping programmers
you can't find a better site.