2

I want to extract opcodes (MOV, ADD, ...etc) from binary files 'exe files' but as I want the process to be completely automated, I was looking for a free disassembler which can be easily integrated preferably a python based tool..

I've found this project : http://www.capstone-engine.org however, I am still trying to figure out how it can be used to extract the opcodes 'it is a bit complicated for me!' and I want some advice 'before spending more time' in terms of whether it is the best and more flexible option available there or not.

any help appreciated.

3 Answers 3

3

The problem with most disassembler libraries - including the excellent Capstone - is that they do only part of the job that you need. They will gladly disassemble any instruction bytes that you feed them, but they won't tell you which bytes in an executable image are instructions or not.

PE32+ executables have to declare all their non-leaf functions in their .pdata sections so that Windows can properly unwind their stack frames; this gives you a good head start if you are dealing with PE32+ (i.e. the AMD64 species of PE). In most other cases you are pretty much left to your own devices unless you have a capable analysis engine like IDA's and a good library of scripts/plugins.

Have a look at the Python plugins for IDA that are floating around on the 'net. Some of them have to duplicate part of IDA's analysis functionality for one reason or another, and so they tend to fall back on libraries like Capstone. These can be a source of inspiration and/or ready-to-use code.

And don't forget to scrutinise Capstone's list of projects that use Capstone; quite a few of them are Python-based and do advanced analysis of executables.

0

The free evaluation version of IDA should meet your needs:

https://www.hex-rays.com/products/ida/support/download_demo.shtml

3
  • There are two problems with the free version of ida: 1. from my 'limited experience' it doesn't look like the free version support the text interface ! which I need to use the program in the batch mode , 2. it says on their website that the 'demo' version will expire at some point and the free one doesn't have a 'linux' version which I need.
    – Ophilia
    Apr 18, 2016 at 8:36
  • 1
    @Ophilia: in fact, the GUI version supports batch processing just fine, you don't have to use the text mode one.
    – Igor Skochinsky
    Apr 18, 2016 at 17:29
  • @Ophilia: I don't believe the time-out will be an issue if you're using it for batch processing, and there is a Linux version at out7.hex-rays.com/files/idademo69_linux.tgz Apr 18, 2016 at 18:03
-1

Try Pyew by Joxean Koret it's open source

1
  • 1
    This answer is, more or less, link only, the software in question hasn't been maintained in 1.5 years, and there's no explanation at all how it connects to the OP's question, and which advantages or disadvantages it has over capstone which was mentioned by the OP. Apr 18, 2016 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.