See what a .exe does

[cristii88bic]

Hello! Does anybody know if it is possible to see what an .exe does? For example, I received a game from a friend, and I want to see what dlls/functions/registrys it opens. Is it possible to make a program with autoit that does that? Resourcehacker does not help me much.

[JRowe]

Hello! Does anybody know if it is possible to see what an .exe does?

Ok. Do a kaspersky check on the file before you check it out, and it will tell you whether it's a virus. IF it's not a virus, then running it will tell you what it does.

Check out Trancexx's stuff (member/forum search will do ya) in the example scripts forum for some reshacker autoit stuff.

Double clicking is usually sufficient. Ymmv. Malware, obviously, should not be executed (I've had too much to drink, so bear with me if this doesn't help.)

Edited November 15, 2009 by JRowe

[Anteaus]

Hello! Does anybody know if it is possible to see what an .exe does? For example, I received a game from a friend, and I want to see what dlls/functions/registrys it opens. Is it possible to make a program with autoit that does that? Resourcehacker does not help me much.

To examine DLL calls in realtime:

http://www.dependencywalker.com/

To track changes made:

http://epsilonsquared.com/installrite.htm

[cristii88bic]

To examine DLL calls in realtime:

http://www.dependencywalker.com/

To track changes made:

http://epsilonsquared.com/installrite.htm

Thank you very much!

[jvanegmond]

And consider sandboxing the application.

[danielkza]

If it's safe to execute (you just need to know what resources the program accesses), I recommend Process Monitor: it can log registry, file, DLL, and other kinds of activity, and has great filtering options.

SysInternals

[rajeshontheweb]

installwatch is the best solution i can think of - coz this is what i use when i suspect the file or if i want to see what the file does (sandboxing is a much safer option, though -- still, i use install watch when i have a legitimate program i would just like to monitor or verify)

[Splash]

Process Montior is the best choice.