Convert .EXE to Source Code!

• Educational Purposes Only •
» Skool Community: www.skool.com/anonymous-9484
» Instagram: / ebolamayne
» GitHub: github.com/EbolaMan-YT
» Patreon: / ebolaman

[@ebolaman_]

0:00 intro 0:13 storytime 1:18 important to learn this 1:47 setting up 2:26 decompiling 3:14 breaking down code 5:23 used on me 6:07 how it works 7:35 outro

[@Kecske_Gaming]

paste this in the description thanks

[@techhub622]

I mistakenly exited the discord channel, please could you share the link?

[@vorax0]

ebola whats your discord server?

[@remy2885]

try oding this with a crypted file 💀

[@shortanimations2922]

@ebolaman_ pls make video on how FUD a exe file

[@neos_hackerspace]

Most malware is written in C/C++ reverse engineering the assembly back is much harder than a simple .NET MSIL executable… That’s why writing malware in interpreted languages makes them weak So this is not that useful to be honest

[@zeez7777]

Yeah especially if its packed and you cant just throw it in ida or ghidra or w/e

[@justind4615]

and even if they are written in C# hacker can just use C# Assembly obfuscators but i havent tried them

[@gauxalot]

@@justind4615c# obfuscators are pretty much useless

[@hecker5556]

​@@hahahaha-hi3wt not much you can do except spend hours reading the assembly figuring out what happens step by step

[@borsukk]

that's another sitty youtuber trying to get kids attention pretending to know anything, don't worry

[@luuu_na35]

I totally have zero experiences about this, but it's cool to know! Thanks for the amazing video!

[@arflopped]

Notes: 3:07 for Forms/WPF apps, yes it does start in the Program class, but I rather suggest looking in the MainForm class as most of the code is located in there 5:00 don't recommend obfuscating! There's a much easier way to ensure that people attempting to reverse engineer your code go through a lot of pain: compiling it into native code. Nick Chapsas has an excellent video on that topic

[@occultsupport]

you never fail to spread our cheeks and fill us with your goodness 😊

[@freezycq]

huh

[@BlazeAaditya-zd1mc]

what

[@Flyingturt1e]

soooo original

[@lollol673]

Ayo?!

[@makemehappy2969]

Ayo WTF?!

[@AniStriking]

good vid and finally you are back

[@justind4615]

also if the program is written not in C# but in C for example its much much harder to reverse engineer also there are tools that obfuscate those C# assemblies

[@dhheisterYT]

know any to use?

[@justind4615]

​@@dhheisterYT what do you mean? programs that obfuscate?

[@dhheisterYT]

@@justind4615 yes

[@justind4615]

@@dhheisterYT I think i commented the program name but it got removed..

[@dhheisterYT]

@@justind4615 perhaps you can commented it on one of my youtube videos

[@johnd.6543]

this literary need 0 RE skills. Default c# compiled files are too easy to decompiled perfectly. You not have to do anything. RE skills need when the executable is compiled with c/c++ for example, where you cannot see function and variable names, compiler optimaze (eg: convert 2 or more functions to 1) and so many times decompilers fail to analyze specific parts or they decompile them wrong and ofc a big challenge is when excutable is protected/packed/obfuscated or virtualized

[@Emorejets]

It's really impressive the things you teach. I was wondering, how did you go about learning all of this?

[@krajeq]

Thank you for your videos, they are very interesting, keep them like that ❤

[@UnrealSecurity]

dnSpy can only decompile .NET executables. It's also wrong to say it gets the original source code because it doesn't necessarily. Addtionally, the managed entrypoint method doesn't have to be named Main inside a class named Program. A lot of unmanaged and managed code can execute before reaching the managed entrypoint. 1. Unmanaged entrypoint (for .NET executables you usually have a single call to _CorExeMain here that kicks off the execution of a .NET program) 2. Managed (.NET) module constructor 3. Static constructor of the class containing the managed entrypoint method 4. Managed entrypoint

[@GorillaTaggingKid_OLD]

One weird thing I've seen with C# is if you make a private async void in visual studio, compile it, then open the source code using DnSpy. The stuff inside the void/function looks odd, it almost looks like it obf itself. If you dont know what I'm talking about try the steps I said above, and if you could please tell me why it does that. Thanks (:

[@Riskeee.]

Reel GorillaTaggingKid???

[@GorillaTaggingKid_OLD]

yes@@Riskeee.

[@GorillaTaggingKid_OLD]

@@Riskeee. yep. HEY MOM, I'M FAMOUS.

[@Riskeee.]

@@GorillaTaggingKid_OLD I’m in ur dc lol

[@GorillaTaggingKid_OLD]

@@Riskeee. bruh

[@nandanray100]

Great as always...keep it u dude...

[@isaacsong-so5um]

wow your vids are really interesting are informative keep it up

[@ZlobnyjKaban]

thanks, that was a useful one. absolutely need more videos about reverse engineering, maybe different methods and tools

[@AzurePages]

The skids are gonna love this

[@brahbah9349]

As a skid i love this 🤫

[@mr.atomictitan9938]

There is also a tool called ghidra that was developed by the NSA. Not as clean cut as what home boy has for dnspy but it can decompile almost any source code.

[@kamoliddintrade]

Your content is very informative. Better than all other youtubers I have seen so far

[@Ahmedblog4games]

egypt is on fire with your content

[@boogaplays123]

Can you make a video on "how games get hacked"

[@IbrahimLubaniShorts]

Yessir

[@Rip622]

But how do they get hacked?

[@zoozer9723]

Fr

[@pec3594]

Fr

[@camerongamer]

THANK YOU, VERY MUCH! edit: i literally inspect malware with notepad by searching for "crypto", "discord", or "token"

[@kamoliddintrade]

how do you do that?

[@jeffjoejnr]

@@kamoliddintrade Drag the file and drop in an empty opened notepad

[@tryingtonot3369]

i love you ebola man

[@TheGravyGuzzler]

This content got me screaming

[@noahrichardson3472]

I fucking LOVE EBOLA MAN

[@TheGabrielMoon]

how do you make to prevent tokens/sessions browser hijacking?

[@x4dam]

W Ebola!

[@oxygen-hostingservertuto870]

token first is that base 64 user id next is when it was created by time and next is random

[@grnm1337]

It's important to note that this is for .NET only. Pretty cool to start, but not very useful for reverse engineering, most malware and secured applications are written in C++ or C. For these languages you need to learn assembly and work with IDA or x64dbg. :)

[@KhanTest-hh4mn]

And visual basic

[@danbromberg]

Yes, I'd like to learn more about reverse engineering and decompiling. Where do I begin? 🙂

[@stolenthings3189]

IDK but bro is glowing

[@trexioasx3391]

Remember guys, this is ONLY for c#. this isnt considered as reverse engineering just deompiling. You cant decompile to easy readable code for C++ .exe/.dll files. To "decompile" c++ applications/libraries you will need to do reverse engineering.

[@Al-Musalmiin]

can you make tutorials on reverse engineering C++ game applications?

[@mrroblick]

This is only for programs that are written in the language C# for NET, NET FRAMEWORK

[@fayking]

you are looking into my soul

[@customgunz00]

bro looks so majestic

[@official.DonaldTrump]

finnaly a "non skid" video

[@hinahammad1047]

it might also be able to open files made with cython

[@MarcoGrassi-uj5os]

Question: Are the cookies encrypted once the have been saved into that folder? How does the code bypass this problem?

[@maxmuster7003]

It is possible to put the bytes of a mashine code inside a batch file to redirect the mashine code into a new executable file with pipe operators(>).

[@MalwareLab150]

I love your video :)

[@OWLyS]

Compiling this using AOT Native will probably make it much harder to reverse it

[@SiFunk]

Ayoo New video 🔥🔥🤙

[@Psychopatz]

Seeing the source code makes my portable Firefox sleep better lol

[@shadowmonster668]

its not "C# Assembly". dotNet framework and dotNet core don't actually compile code directly into assembly or any type of actual machine code. its "compiled" into IL which is intermediate language that is a step up from assembly that is still very readable and doesnt share many similarities with asm. .Net core and framework runtime libraries are essentially interpreters for IL and thats why it needs to be on your computer to run it. MSIL is the reason .net can be cross platform because it isnt actually being compiled and is just interpreted during run time kinda like python (massive overstatement but the basis is there).

[@darkfllame]

nah fr, it only works on .NET executables though. if you have a native executable you're gonna need a disassembler (like IDA or dbg64) or smth and reverse ingeneering the hard way with assembly which is hard and painful, after that you can *understand* (and not decompile) the code. Because native code symbols is often mangled or unexposed (labels are not exported), you can't get them back.

[@Joefry.]

Seeing malware released without a stripped binary always confuses me, why would you release it with compilation info/debug symbols Idk if you can strip that from .NET C# programs though, I've never tried it before

[@egg.egg.egg.egg.]

egg.

[@ezaldey611]

🥚

[@TooMuchPing]

egg.

[@alexaccount1]

egg.

[@chigga5years173]

Egg.

[@EpicNoobx]

egg.

[@seansingh4421]

*Laughs in Applocker 😂😂

[@user-yz9ld1cg4d]

Keep it up buddy make more reverse engineering videos ❤

[@finn7798]

bro you are majestic

[@FeTetra]

the nature of .net c# makes it really easy to do this, writing malware in c# is very counterintuitive because of this most of the time malware is written in languages like c or c++ which is many times harder to actually decompile after it is disassembled, full decompilation projects for software written in these common languages have historically had many contributers and can take years to complete

[@Fevirre]

Whats funny that they have their entire webhook open meaning you can just spam the hell out of their webhook with that url, if you run the exe through triage you can get their bot token and login through a bot client and screw with them that way too

[@omarsplaytimechannel]

Finally, the secret method.

[@terrasystemlabs]

but dnspy is only for .NET, is there a way to know in which language a binary was made?

[@maxmuster7003]

I like to use batch files as an open source container to put the instructions of a routine inside to create a new executable file to run inside the encapsulated DosBox emulation. So all instructions are visible and not hidden and i never made malware or a virus.

[@lcm_2080]

If i drag in an exe it only shows PE Is that if its a shortcut?

[@honestsniping1]

No, its most likely because the exe is not a .NET exe. Shortcuts are not PE. PE files are exe, dll, etc.

[@joelav33]

im gonna listen to it all first but im at 2min07 and question popped in my head, are you sure i should trust that .exe?

[@carpye2774]

appreciate tecca in background

[@user-gq5bc6zy5p]

does it works for cubase pro tools mairlist thank you so much

[@skillerghg5796]

he send you a free grabber you just need to change the weebhook lmao haha

[@orren6999]

Opinions on hello kitty?

[@mirozo]

mine doesnt open code. only // location and // timestamp with only PE tab

[@johnd.6543]

as he said only works with .net c# compiled executables

[@PogoDigitalism]

This is only for .NET compiled executables. Not for C/c++ compiled malware..

[@user-zh4bl5xz7r]

IIRC It also wont work with languages such as rust.

[@MB-hg3lh]

Whens the new server coming

[@OfficialAfterLifeEdits]

ur the beeest ytber EVER thanks for the cmd hacks respect

[@Shoxa_4ever]

congrat for new room

[@BnodChaudharyBunny]

you just earn a new subscriber

[@softwhere07]

Is there a way to have it like converted to like a python code?

[@heisenberg5297]

i thought you were going to use apps like x64dbg and view the assembly code. u cant do anything with dnspy to app that has been fully converted to machine language

[@reidafesta9131]

x64dbg is a debugger for native. ida pro would prob be the best for static analysis

[@adhero1337]

what are these leds in back

[@soonapt]

Dose this work on other programming languages too like for example Python?

[@AnonymousApexio]

no

[@thegrimreaper6964]

bro what would you suggest an app for android just like cheat engine.

[@thepurplekingdavis7284]

btw i got from moom an rat he said it was an rat setup ( the discord server is down bc someone did smth ) ( hes one of my friends the one who takethe server down)

[@nesadlevent]

Amazing job! Can you teach us how to create pixel trigger bot? (educational purposes only)

[@DEFHerobrine]

what if there is no real code visible? i just have the folder PE

[@UNSP0KENMC]

Hey, love your vids. Is there any way that you could teach us how to deobfuscate stuff?

[@asy42699]

help, i know this is irrelevant but my phone got stolen is there a way i can trace it (tried google maps and it didnt work)

[@boreneoman7728]

why there's no firefox in that list? it wont work on firefox?

[@dead_protagonist]

bro says his "T's" very aggressively

[@Veso266]

Could u share the original bat and vbs file? Would realy like to see what happens before u get the exe

[@asapcoder]

Ebola my love

[@jkghj28ff]

And if there is just PE?

[@gTL_1337]

really nice video! personally I'd be interested in reversing/cracking simple software, like just bypassing a simple "password:" input in a python .exe file. Have a great day!

[@Zephyl2837]

Can you create an invite link for your discord server?

[@zgrz6tuuu]

thanks man youre the best coder

[@llaarnes]

Nice content. Thx man

[@BarkSaw]

This guy is the master of clickbait, he didnt even use Ghidra

[@Ar4an]

Thanks for info ❤

[@VNR_clips]

C# .exe can be encoded tho, and even so if this is not useful at all if you code in c++

[@yashu_2803]

really helpfull no more viruses

[@elemento281]

i've used dnspy before to modify games, but holy shit i didn't realize how powerful this tool is.

[@user-yt1dh5zh7y]

hi ebola man, great vid but i have a suggestion, can you do a video on how hackers crack passwords in kali linux .(Tools like hydra or john the ripper).PLS

[@KaptanUfuk]

video banner : c++/c irl : non obfuscated c#

[@door_vr4651]

Bro some guy on discord sent me a .exe and I ran it and my discord account got hacked and he kept sending my address and ip to everyone and now I’m sad this happened yesterday

[@keyon_renner]

Moral of the story: Use a C2 server

[@Exploit-999]

Thanks sir

[@DiamondSaberYT]

I clicked thinking there’s a new tool that converts asm instructions from an exe to somewhat readable and formatted c.

[@augiaii5130]

Genuine question whhy do people use token grabbers?

[@yura69699]

what if its encrypted

[@omerahmed4066]

The sys32 file on your computer actually trys to stop your computer from revealing source code to keep copyrighted code from being distributed, so if you delete that, then go to settings > advanced > debug mode and turn debug on, you can reveal source code by just right clicking and pressing decompile in the context menu.

[@yura69699]

@@omerahmed4066 you got discord?????

[@mrbeltrattore]

If the file is encrypted you do nothing

[@yura69699]

@@mrbeltrattore uhh ok

[@ziqwu]

@@omerahmed4066 nice one so original

[@X4Alpha4X]

what do i do when the EXE only has a PE header?

[@theaviationbee]

Then the file is probably not written in C#