# How to Detect a Backdoor in a Tool

**URL:** <https://onehack.st/t/how-to-detect-a-backdoor-in-a-tool/54889>\
**Category:** Tutorials & Methods\
**Tags:** hacking, tips-tricks\
**Created:** [August 29, 2019, 11:14am UTC](https://onehack.st/t/how-to-detect-a-backdoor-in-a-tool/54889 "2019-08-29T11:14:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [August 29, 2019, 11:14am UTC](https://onehack.st/t/how-to-detect-a-backdoor-in-a-tool/54889/1 "2019-08-29T11:14:01Z")

</div>

![shutterstock_577188427-compressor](https://onehack.st/uploads/default/original/3X/2/2/228749f0b27354125f80c3beff969536c665c59d.jpeg)

- 
  1. Right click on the any suspicious tool and if you have winrar installed and if it shows “open with winrar” then this means it was binded with winrar so that tool is backdoored.

- 
  1. open it with a resource editor such as resource hacker/restorator/pe explorer and check the rcdata section,if theres 1 & 2 entries in it  
then its binded.

- 
  1. open it with a hex editor , at the start of a PE header theres always this line “This program cannot be run in DOS mode” , search for it,if it  
exists more then once then it might be binded  
it depends on the specific app,for example its not unusual for  
binders/crypters to have the stub file attached in the resources  
also search for .exe and inspect the results,a binded file  
drops the files to a temp folder before executing em , so if  
you find somethin like this: %.t.e.m.p.%..x.x…e.x.e or file1.exe/file2.exe  
then its binded.

- 
  1. run it in sandboxie ,when a file is executed in sandboxie its isolated (cant access your files/registry, first click the sandboxie tray icon to  
open up its Window , then right click the file and click “run with sandboxie”  
if you see another process name in the sandboxie Window then its probably backdoored (this doesnt include sandboxie rpcss/dcom launch processes,those are legit and needed for some programs).

---

<div class="post-metadata">

**Author:** ![Mesh\_Chopra](https://onehack.st/user_avatar/onehack.st/mesh_chopra/32/24597_2.png) [@Mesh\_Chopra](https://onehack.st/u/Mesh_Chopra)\
**Post date:** [August 29, 2019, 10:27pm UTC](https://onehack.st/t/how-to-detect-a-backdoor-in-a-tool/54889/2 "2019-08-29T22:27:59Z")

</div>

Thank you for this useful infos.

---

<div class="post-metadata">

**Author:** ![optimus\_prime](https://onehack.st/user_avatar/onehack.st/optimus_prime/32/20928_2.png) [@optimus\_prime](https://onehack.st/u/optimus_prime)\
**Post date:** [August 30, 2019, 4:28am UTC](https://onehack.st/t/how-to-detect-a-backdoor-in-a-tool/54889/3 "2019-08-30T04:28:48Z")

</div>

Thank you TheJoker. 👍👏