Programs in the Windows environment communicate with the system by using Windows APIs. These APIs are built around the file system, memory management (including processes, the stack, and allocations), the registry hive, network communication, and so forth. Regarding reverse engineering, a wide coverage of these APIs and their library modules is a good advantage when it comes to easily understanding how a program works when seen in its low-level language equivalent. So, the best way to begin exploring APIs and their libraries would be to develop some programs ourselves.
There are many high-level languages used by developers like C, C++, C#, and Visual Basic. C, C++, and Visual Basic (native) compile to an executable that directly executes instructions in the x86 language. C# and Visual Basic (p-code) are usually compiled to use interpreters as a layer that turns the p-code into actual x86 instructions. For this chapter, we will focus on executable binaries compiled from C/C++ and assembly language. The goal is to have a better understanding of the behavior of programs that use Windows APIs.
For this chapter, our choice for building C/C++ programs will be the Visual Studio Community edition. Visual Studio is widely used for building Microsoft Windows programs. Given that it is also a product of Microsoft, it already contains the compatible libraries required to compile programs. You can download and install Visual Studio Community edition from https://visualstudio.microsoft.com/downloads/.
These programs are neither harmful nor malicious. The following C programming activities can be done with Visual Studio in a bare metal machine. In case you are planning on installing Visual Studio in a Windows VM, at the time of writing this book, Visual Studio 2017 Community edition has the following recommended system requirements:
- 1.8 GHz dual core
- 4 GB of RAM
- 130 GB of disk space
These system requirements can be found at https://docs.microsoft.com/en-us/visualstudio/productinfo/vs2017-system-requirements-vs. You may need to perform some Windows updates and install the .NET framework. This can also be installed from the Windows 7 setup that we previously downloaded from https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ . Please visit the Microsoft Visual Studio website for the requirements of newer versions.
There are many Visual Studio alternatives that have minimal requirements like Bloodshed Dev C++, Zeus IDE, and Eclipse. However, some of these IDE may not be up-to-date and/or may need to the compiler and its dependencies to have been properly set up.