Initial file information

To get the filename, file size, hash calculations, file type, and other information regarding the file, we will be using CFF Explorer. When opening the file, we might encounter an error message when using the latter, as can be seen in the following screenshot:

This error is caused by MS Windows' virus protection feature. Since we are in a sandboxed environment (under a virtualized guest environment), it should be okay to disable this. Disabling this feature in a production environment can expose risks for the computer getting compromised by malware.

To disable this feature in Windows, select Start->Settings->Windows ...

Get Mastering Reverse Engineering now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.