We now end up in the follow part of the code, this is the part of the code we will be adjusting. Search for “P2XDLL” string, Right Click + Follow in Disassembler  (or double click it). text part of the Perl2Exe dll file (p2x5NNN.dll) and Right Click + Follow in Disassembler (or  press Enter) Right Click the main window and Search for –> String references (or Right Click, S, S)Įxecute the program till it hits the RunPerl breakpoint ( Debug –> Run or press F9). You might need to press F9 more than once before it hits our breakpoint. text part of Perl2Exe executable and Right Click + Follow in Disassembler (or  press Enter) Go to the Memory Map by clicking the Memory Map tab (or press Alt-M) Open the Perl2Exe executable in 圆4_dbg with File –> Open (or press F3). This file was created with Perl2Exe v16.00 and Strawberry Perl 5.16.3 for Windows on Windows 7 64-bit. You can download the 64-bit Perl2Exe test-file here: Example_code_Perl2Exe_v16-圆4.exe Print "\n This is just a test line.\n\n" Print "\n Perl2exe Perl sourcecode revealer test code - 64bit\n". The code of this test program is shown below. I created a short test program to test the approach described in the article. Updated instructions for this version can be found at the end of the article. Update 15-02-2017: User Julian commented on this article below that the instructions did not work on binaries created with Perl2Exe version 24. These details have been left out of this current article.
I decided to create this fairly short write-up about how to do this, which can also be used as a first hands-on with 圆4_dbg.įor reference, the approach for 32-bit Perl2Exe executables (using OllyDbg) can be found here, which also describes how Perl2Exe works and what the idea is behind the approach that we also follow in this article. While I am still looking forward to the 64-bit version of OllyDbg, this new debugger looks very promising and with it I was able to create a fairly simple way of recovering the Perl sourcecode of 64-bit Perl2Exe executables. However, that has changed with the release of 圆4_dbg. Sadly enough at that time there was no free and easy to use 64-bit debugger available to create a similar approach for 64-bit Perl2Exe executables. After posting information on my website about the Perl2Exe reversing article I published before, I got a comment with a question on how to perform the same “trick” on 64-bit Perl2Exe executables.
0 kommentar(er)
