Initial file information

To get the filename, file size, hash calculations, file type, and other information regarding the file, we will be using CFF Explorer. When opening the file, we might encounter an error message when using the latter, as can be seen in the following screenshot:

This error is caused by MS Windows' virus protection feature. Since we are in a sandboxed environment (under a virtualized guest environment), it should be okay to disable this. Disabling this feature in a production environment can expose risks for the computer getting compromised by malware.

To disable this feature in Windows, select Start->Settings->Windows ...

Get Mastering Reverse Engineering now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.