-1

I am currently reverse engineering a small native library from an Android Phone. I have the .so file in x86, ARM and some others but I decided to take the x86 because it's probably the easiest to disassemble.

I have manually disassembled it and slowly see what it's doing but then I ran into a problem. I tried different disassemblers and they sometimes give unconsistent results. There are sometimes very weird instructions that don't make any sense, especially with the LEA command. So I thought I can manually look up how the bytes for that instruction are encoded and get my own correct solution. Sadly I haven't found any description how native bytecode looks and is encoded. There are many large databases for the Opcodes but they just give a description and not how the bytecode for it is encoded. Maybe I have searched the wrong terms but I would be glad if you could link me something more detailed so I can verify the instructions by hand when they seem obscure.

Thanks in advance, SkryptX

3

The tables at sandpile.org are always handy for things like that but on the whole you're much better off using an existing disassembler, like the free version of IDA.

Working manually you can usually look up all the prefixes and the primary opcode, but then you've still got to decode additional bytes like the mod/rm byte and also apply all the modal information: decoding differences between the various operating modes of the x86 architecture, different meaning of modifiers like address and operand size overrides, and a gazillion other things. A good disassembler does all that boring work for you and makes several orders of magnitude fewer mistakes. That leaves you free to ponder the meaning of the disassembly...

Last but not least, good disassemblers like IDA are scriptable so that you can have your computer do all kinds of things for you that the disassembler cannot do right out of the box.

Free IDA can be scripted in IDA C script but not in Python (at least not without jumping through major hoops). So you could turn things around and load a disassembler library into Python, like the excellent Capstone. Python also has craptons of utility libraries for processing binaries, so almost all of the work has already been done for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.