4

a simple portable executable file looks like :

enter image description here

I'm wondering how a disassembler works to parse the .text...to produce assembly code ?

Because the PE file in his raw format seems to be unusable and does not contain machine instructions in readable format.

I was thinking about either a tier program is used, or the program is loaded into memory and a dump is performed by the disassembler.

Thanks !

Improve this question
3
  • 4
    The instructions do not immediately follow that text .text. You are looking at a table of contents; the binary numbers after the name indicate the offset and length where, in the total file, the actual code can be found.
    – Jongware
    Commented Dec 6, 2015 at 13:01
  • 1
    Google "PE format". That's what loaders in IDA Pro are partially for. msdn.microsoft.com/en-us/library/ms809762.aspx
    – Vitaly Osipov
    Commented Dec 6, 2015 at 21:02
  • It probably has a byte pattern to match against a function preamble and starts from there. Not to mention the start address is explicitly stated in the file somewhere
    – ratchet freak
    Commented Dec 6, 2015 at 23:17

3 Answers 3

Reset to default
4

You have basically two options:

Linear Sweep

Read the first N-bytes until you get a correct opcode (e.g., 05 14 00 00 00 decompiles to add eax,0x14). Disassemble the next opcode. You will read some data sections and get invalid opcodes. You may skip the process or mark these "instructions" as bad and proceed until you get the next valid opcode and resume as described.

Recursive Traversal

Read the first N-bytes until you get a correct opcode. Proceed until you disassemble any sort of jump, store your current position, follow the jump and proceed as described. Stop disassembly when you get an invalid opcode and resume at the previously stored position.

Both approaches require some basic information like

  • Where does your program code start?
  • What architecture is the code for?

Some of these information are part of the header (e.g., in PE- oder ELF-Files).

The Linux Interactive DisAssembler (LIDA) has a short introduction how the program disassembles the code and how objdump does its work. This is a good starting point to get familiar with the topic.

Improve this answer
1

There are a number of ways to disassemble a file. And note that .text is only a name for the segment, you can call it .flups for all the OS cares.

The things that are interesting is that:

  • The OEP is within that section
  • The section has Read and Execute rights.

A disassembler can just jump to EOP and start reading bytes (opcodes) (http://ref.x86asm.net/). It can just start reading from the top down or it can also enumerate the results, eg follow calls/jmps in order to find weird code.

Also, in the DosHeader there is a reference to where the PE here starts. This one has the OEP for you.

Reading the radare source code can help you really understanding disassemblers.

Improve this answer
1

There's indeed a bunch of processing happens between having a raw PE, ELF, etc. file, to be able to disassemble it and show in a nice UI: loading and parsing a file, processing executable sections, converting offsets to virtual addresses, mnemonic disassembly itself, annotation of parts of disassembled instructions to allow e.g. to crossreference different parts of code/data and easily navigate among them, etc.

There're number of open-source disassemblers whose code you can study to get more insight into inner workings (or to improve for your needs!). For example, ScratchABit is written in Python, is very easy to study and hack on.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.