My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused.
5 Answers
No, you don't.
Despite the name, "IDA Pro 64" allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).
answered Sep 15, 2017 at 8:30
The disassembler program can be of any bitness and platform. The programmer only needs to have an understanding of the file format. With this knowledge, you could implement an x64 disassembler even for a 16 bit CPU.
However, you might not be able to run and debug the code. But that's not a disassembler any more then.
your question is not clear if you are interested in only disassembling 64 bit code in a 32 bit computer using a 32 bit executable you can check disassemblers like disasm by airesoft
or cook one using capstone etc
iirc hexeditors like hte or bdasm can also handle disassembling 64bit code in 32 bit computers haven't used them lately but i remember using them to disassemble elf files in windows
a sample output disassembly of x64 windbg.exe wmain function ala objdump style using disasm.exe from airesoft
:\>DisAsm.exe "e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\windbg.exe" wmain -blf > foo.txt
:\>head foo.txt
twitter.com/ThatThereClaire
No size info found for wmain. Approximating...
No size info found for wmainCRTStartup. Approximating...
windbg!wmain:
00000000`4003e458 488bc4 mov rax,rsp
00000000`4003e45b 48895808 mov qword ptr [rax+8],rbx
00000000`4003e45f 48897010 mov qword ptr [rax+10h],rsi
00000000`4003e463 48897818 mov qword ptr [rax+18h],rdi
00000000`4003e467 55 push rbp
00000000`4003e468 4154 push r12
you can also use windbg -z to disassemble a 64 bit binary in a 32 bit computer as shown below
C:\>cdb -z "e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll"
Microsoft (R) Windows Debugger Version 10.0.15063.400 X86
ModLoad: 00000001`80000000 00000001`80626000 e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll
0:000> uf dbgeng!PopOutCtl
dbgeng!PopOutCtl:
00000001`80066160 4053 push rbx
00000001`80066162 4883ec20 sub rsp,20h
00000001`80066166 488bd9 mov rbx,rcx
00000001`80066169 e8ba070000 call dbgeng!FlushCallbacks (00000001`80066928)
00000001`8006616e 8b03 mov eax,dword ptr [rbx]
00000001`80066170 890566a65300 mov dword ptr [dbgeng!g_OutputControl (00000001`805a07dc)],eax
00000001`80066176 488b4308 mov rax,qword ptr [rbx+8]
00000001`8006617a 4889057f575400 mov qword ptr [dbgeng!g_OutputClient (00000001`805ab900)],rax
00000001`80066181 8b4310 mov eax,dword ptr [rbx+10h]
00000001`80066184 89056e575400 mov dword ptr [dbgeng!g_BufferOutput (00000001`805ab8f8)],eax
00000001`8006618a 8b4314 mov eax,dword ptr [rbx+14h]
00000001`8006618d 890565a65300 mov dword ptr [dbgeng!g_OutputWidth (00000001`805a07f8)],eax
00000001`80066193 488b4318 mov rax,qword ptr [rbx+18h]
00000001`80066197 48890542da5400 mov qword ptr [dbgeng!g_OutputLinePrefix (00000001`805b3be0)],rax
00000001`8006619e 4883c420 add rsp,20h
00000001`800661a2 5b pop rbx
00000001`800661a3 c3 ret
0:000>
To add to many "No" responses: the latest "64 bit disassembler/IDA Pro" refers to the disassembler application itself - that it executes in 64 bit mode (a bit faster, and generally nicer to the OS, as they are all 64 bit there days). This has nothing to do with what code it can disassemble. The capabilities of the latest release are largely the same as previous, "32-bit" release. At least on the level of how most non-pros look at it.
64-bit IDA Pro will probably break all pre-compiled plugins, though, as they are all compiled in 32-bit mode. I haven't checked.
As answered by others, you don't need a specific build of IDA Pro to disassemble 64-bit code, there're many other alternatives. For example ScratchABit is free, open-source interactive disassembler which supports both 32-bit and 64-bit x86 code and is easily extensible to other architectures.
