[SOLVED] Checking code for having concrete commands

Checking code for having concrete commands

I have .exe file with python code. How can I check, contains my file concrete command(for example os.remove("system32"))?

Solution

You'll have to decompile the exe, depending on how it was compiled you might need to use a different tool but I'd suggest pyinstxtractor. Then you can do something like this to search for any malicious commands within the source code.

import os

def commandSearch(directory, command):
    # Traverse directory as result of decompiling
    for root, _, files in os.walk(directory):
        for file in files:
            # If python file found, open in read mode
            if file.endswith('.py'):
                with open(os.path.join(root, file), 'r') as f:
                    content = f.read()
                    # Search for malicious commands
                    if command in content:
                        print(f"Command found in {file}")

commandSearch('your_directory', 'your_command')

You'll have to try and find out what tool/python version was used to compile to use the relevant decompiler. From there you will also likely have to convert the .pyc files to source code.