merhabalar elimde .exe uzantılı bir program var hangi dilde yazıldığını da öğrendim kaynak kodlarına erişmem lazım fakat çok değişik bir şifrelenme tarzı var belki 10 belki 20 program denedim çoğusu açmadı bile hata verdi bir tek dnspy programı ile makine kodlarına ulaşabildim çıkan çıktı şu şekilde ne yapabilirim açıkçası tersine mühendislikte ilk deneyimlerimden biri olacak yardımcı olursanız çok sevinirim.
Kod:
// PE
// All tree nodes below use the hex editor to modify the PE file
//
// 00000000 - 0000003F DOS Header
//
// IMAGE_DOS_HEADER:
// 00000000 - 00000001 5A4D = e_magic
// 00000002 - 00000003 0090 = e_cblp
// 00000004 - 00000005 0003 = e_cp
// 00000006 - 00000007 0000 = e_crlc
// 00000008 - 00000009 0004 = e_cparhdr
// 0000000A - 0000000B 0000 = e_minalloc
// 0000000C - 0000000D FFFF = e_maxalloc
// 0000000E - 0000000F 0000 = e_ss
// 00000010 - 00000011 00B8 = e_sp
// 00000012 - 00000013 0000 = e_csum
// 00000014 - 00000015 0000 = e_ip
// 00000016 - 00000017 0000 = e_cs
// 00000018 - 00000019 0040 = e_lfarlc
// 0000001A - 0000001B 0000 = e_ovno
// 0000001C - 0000001D 0000 = e_res[0]
// 0000001E - 0000001F 0000 = e_res[1]
// 00000020 - 00000021 0000 = e_res[2]
// 00000022 - 00000023 0000 = e_res[3]
// 00000024 - 00000025 0000 = e_oemid
// 00000026 - 00000027 0000 = e_oeminfo
// 00000028 - 00000029 0000 = e_res2[0]
// 0000002A - 0000002B 0000 = e_res2[1]
// 0000002C - 0000002D 0000 = e_res2[2]
// 0000002E - 0000002F 0000 = e_res2[3]
// 00000030 - 00000031 0000 = e_res2[4]
// 00000032 - 00000033 0000 = e_res2[5]
// 00000034 - 00000035 0000 = e_res2[6]
// 00000036 - 00000037 0000 = e_res2[7]
// 00000038 - 00000039 0000 = e_res2[8]
// 0000003A - 0000003B 0000 = e_res2[9]
// 0000003C - 0000003F 00000108 = e_lfanew
//
// 0000010C - 0000011F File Header
//
// IMAGE_FILE_HEADER:
// 0000010C - 0000010D 8664 = Machine
// 0000010E - 0000010F 0007 = NumberOfSections
// 00000110 - 00000113 5FB4E109 = TimeDateStamp
// 00000114 - 00000117 00000000 = PointerToSymbolTable
// 00000118 - 0000011B 00000000 = NumberOfSymbols
// 0000011C - 0000011D 00F0 = SizeOfOptionalHeader
// 0000011E - 0000011F 0022 = Characteristics
//
// 00000120 - 0000020F Optional Header (64-bit)
//
// IMAGE_OPTIONAL_HEADER64:
// 00000120 - 00000121 020B = Magic
// 00000122 - 00000122 0E = MajorLinkerVersion
// 00000123 - 00000123 00 = MinorLinkerVersion
// 00000124 - 00000127 00020400 = SizeOfCode
// 00000128 - 0000012B 00062A00 = SizeOfInitializedData
// 0000012C - 0000012F 00000000 = SizeOfUninitializedData
// 00000130 - 00000133 000088B8 = AddressOfEntryPoint
// 00000134 - 00000137 00001000 = BaseOfCode
// 00000138 - 0000013F 0000000140000000 = ImageBase
// 00000140 - 00000143 00001000 = SectionAlignment
// 00000144 - 00000147 00000200 = FileAlignment
// 00000148 - 00000149 0005 = MajorOperatingSystemVersion
// 0000014A - 0000014B 0002 = MinorOperatingSystemVersion
// 0000014C - 0000014D 0000 = MajorImageVersion
// 0000014E - 0000014F 0000 = MinorImageVersion
// 00000150 - 00000151 0005 = MajorSubsystemVersion
// 00000152 - 00000153 0002 = MinorSubsystemVersion
// 00000154 - 00000157 00000000 = Win32VersionValue
// 00000158 - 0000015B 00092000 = SizeOfImage
// 0000015C - 0000015F 00000400 = SizeOfHeaders
// 00000160 - 00000163 00000000 = CheckSum
// 00000164 - 00000165 0002 = Subsystem
// 00000166 - 00000167 8160 = DllCharacteristics
// 00000168 - 0000016F 0000000000100000 = SizeOfStackReserve
// 00000170 - 00000177 0000000000001000 = SizeOfStackCommit
// 00000178 - 0000017F 0000000000100000 = SizeOfHeapReserve
// 00000180 - 00000187 0000000000001000 = SizeOfHeapCommit
// 00000188 - 0000018B 00000000 = LoaderFlags
// 0000018C - 0000018F 00000010 = NumberOfRvaAndSizes
// 00000190 - 00000193 00000000 = Export.VirtualAddress
// 00000194 - 00000197 00000000 = Export.Size
// 00000198 - 0000019B 00030B14 = Import.VirtualAddress
// 0000019C - 0000019F 00000064 = Import.Size
// 000001A0 - 000001A3 00041000 = Resource.VirtualAddress
// 000001A4 - 000001A7 0004FD88 = Resource.Size
// 000001A8 - 000001AB 0003E000 = Exception.VirtualAddress
// 000001AC - 000001AF 00001C74 = Exception.Size
// 000001B0 - 000001B3 00000000 = Security.VirtualAddress
// 000001B4 - 000001B7 00000000 = Security.Size
// 000001B8 - 000001BB 00091000 = Base Reloc.VirtualAddress
// 000001BC - 000001BF 00000690 = Base Reloc.Size
// 000001C0 - 000001C3 0002EB40 = Debug.VirtualAddress
// 000001C4 - 000001C7 0000001C = Debug.Size
// 000001C8 - 000001CB 00000000 = Architecture.VirtualAddress
// 000001CC - 000001CF 00000000 = Architecture.Size
// 000001D0 - 000001D3 00000000 = Global Ptr.VirtualAddress
// 000001D4 - 000001D7 00000000 = Global Ptr.Size
// 000001D8 - 000001DB 00000000 = TLS.VirtualAddress
// 000001DC - 000001DF 00000000 = TLS.Size
// 000001E0 - 000001E3 0002EB60 = Load Config.VirtualAddress
// 000001E4 - 000001E7 00000094 = Load Config.Size
// 000001E8 - 000001EB 00000000 = Bound Import.VirtualAddress
// 000001EC - 000001EF 00000000 = Bound Import.Size
// 000001F0 - 000001F3 00022000 = IAT.VirtualAddress
// 000001F4 - 000001F7 00000328 = IAT.Size
// 000001F8 - 000001FB 00000000 = Delay Import.VirtualAddress
// 000001FC - 000001FF 00000000 = Delay Import.Size
// 00000200 - 00000203 00000000 = .NET.VirtualAddress
// 00000204 - 00000207 00000000 = .NET.Size
// 00000208 - 0000020B 00000000 = Reserved15.VirtualAddress
// 0000020C - 0000020F 00000000 = Reserved15.Size
//
// 00000210 - 00000237 Section #0: .text
//
// IMAGE_SECTION_HEADER:
// 00000210 - 00000217 .text = Name
// 00000218 - 0000021B 000203A0 = VirtualSize
// 0000021C - 0000021F 00001000 = VirtualAddress
// 00000220 - 00000223 00020400 = SizeOfRawData
// 00000224 - 00000227 00000400 = PointerToRawData
// 00000228 - 0000022B 00000000 = PointerToRe********s
// 0000022C - 0000022F 00000000 = PointerToLinenumbers
// 00000230 - 00000231 0000 = NumberOfRe********s
// 00000232 - 00000233 0000 = NumberOfLinenumbers
// 00000234 - 00000237 60000020 = Characteristics
//
// 00000238 - 0000025F Section #1: .rdata
//
// IMAGE_SECTION_HEADER:
// 00000238 - 0000023F .rdata = Name
// 00000240 - 00000243 0000F61E = VirtualSize
// 00000244 - 00000247 00022000 = VirtualAddress
// 00000248 - 0000024B 0000F800 = SizeOfRawData
// 0000024C - 0000024F 00020800 = PointerToRawData
// 00000250 - 00000253 00000000 = PointerToRe********s
// 00000254 - 00000257 00000000 = PointerToLinenumbers
// 00000258 - 00000259 0000 = NumberOfRe********s
// 0000025A - 0000025B 0000 = NumberOfLinenumbers
// 0000025C - 0000025F 40000040 = Characteristics
//
// 00000260 - 00000287 Section #2: .data
//
// IMAGE_SECTION_HEADER:
// 00000260 - 00000267 .data = Name
// 00000268 - 0000026B 0000B0F8 = VirtualSize
// 0000026C - 0000026F 00032000 = VirtualAddress
// 00000270 - 00000273 00000C00 = SizeOfRawData
// 00000274 - 00000277 00030000 = PointerToRawData
// 00000278 - 0000027B 00000000 = PointerToRe********s
// 0000027C - 0000027F 00000000 = PointerToLinenumbers
// 00000280 - 00000281 0000 = NumberOfRe********s
// 00000282 - 00000283 0000 = NumberOfLinenumbers
// 00000284 - 00000287 C0000040 = Characteristics
//
// 00000288 - 000002AF Section #3: .pdata
//
// IMAGE_SECTION_HEADER:
// 00000288 - 0000028F .pdata = Name
// 00000290 - 00000293 00001C74 = VirtualSize
// 00000294 - 00000297 0003E000 = VirtualAddress
// 00000298 - 0000029B 00001E00 = SizeOfRawData
// 0000029C - 0000029F 00030C00 = PointerToRawData
// 000002A0 - 000002A3 00000000 = PointerToRe********s
// 000002A4 - 000002A7 00000000 = PointerToLinenumbers
// 000002A8 - 000002A9 0000 = NumberOfRe********s
// 000002AA - 000002AB 0000 = NumberOfLinenumbers
// 000002AC - 000002AF 40000040 = Characteristics
//
// 000002B0 - 000002D7 Section #4: .gfids
//
// IMAGE_SECTION_HEADER:
// 000002B0 - 000002B7 .gfids = Name
// 000002B8 - 000002BB 000000AC = VirtualSize
// 000002BC - 000002BF 00040000 = VirtualAddress
// 000002C0 - 000002C3 00000200 = SizeOfRawData
// 000002C4 - 000002C7 00032A00 = PointerToRawData
// 000002C8 - 000002CB 00000000 = PointerToRe********s
// 000002CC - 000002CF 00000000 = PointerToLinenumbers
// 000002D0 - 000002D1 0000 = NumberOfRe********s
// 000002D2 - 000002D3 0000 = NumberOfLinenumbers
// 000002D4 - 000002D7 40000040 = Characteristics
//
// 000002D8 - 000002FF Section #5: .rsrc
//
// IMAGE_SECTION_HEADER:
// 000002D8 - 000002DF .rsrc = Name
// 000002E0 - 000002E3 0004FD88 = VirtualSize
// 000002E4 - 000002E7 00041000 = VirtualAddress
// 000002E8 - 000002EB 0004FE00 = SizeOfRawData
// 000002EC - 000002EF 00032C00 = PointerToRawData
// 000002F0 - 000002F3 00000000 = PointerToRe********s
// 000002F4 - 000002F7 00000000 = PointerToLinenumbers
// 000002F8 - 000002F9 0000 = NumberOfRe********s
// 000002FA - 000002FB 0000 = NumberOfLinenumbers
// 000002FC - 000002FF 40000040 = Characteristics
//
// 00000300 - 00000327 Section #6: .reloc
//
// IMAGE_SECTION_HEADER:
// 00000300 - 00000307 .reloc = Name
// 00000308 - 0000030B 00000690 = VirtualSize
// 0000030C - 0000030F 00091000 = VirtualAddress
// 00000310 - 00000313 00000800 = SizeOfRawData
// 00000314 - 00000317 00082A00 = PointerToRawData
// 00000318 - 0000031B 00000000 = PointerToRe********s
// 0000031C - 0000031F 00000000 = PointerToLinenumbers
// 00000320 - 00000321 0000 = NumberOfRe********s
// 00000322 - 00000323 0000 = NumberOfLinenumbers
// 00000324 - 00000327 42000040 = Characteristics
