3

My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused.

6

No, you don't.

Despite the name, "IDA Pro 64" allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).

| improve this answer | |
0

The disassembler program can be of any bitness and platform. The programmer only needs to have an understanding of the file format. With this knowledge, you could implement an x64 disassembler even for a 16 bit CPU.

However, you might not be able to run and debug the code. But that's not a disassembler any more then.

| improve this answer | |
0

your question is not clear if you are interested in only disassembling 64 bit code in a 32 bit computer using a 32 bit executable you can check disassemblers like disasm by airesoft

or cook one using capstone etc

iirc hexeditors like hte or bdasm can also handle disassembling 64bit code in 32 bit computers haven't used them lately but i remember using them to disassemble elf files in windows

a sample output disassembly of x64 windbg.exe wmain function ala objdump style using disasm.exe from airesoft

:\>DisAsm.exe "e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\windbg.exe" wmain -blf > foo.txt

:\>head foo.txt
twitter.com/ThatThereClaire
No size info found for wmain. Approximating...
No size info found for wmainCRTStartup. Approximating...
windbg!wmain:
                           00000000`4003e458 488bc4          mov     rax,rsp
                           00000000`4003e45b 48895808        mov     qword ptr [rax+8],rbx
                           00000000`4003e45f 48897010        mov     qword ptr [rax+10h],rsi
                           00000000`4003e463 48897818        mov     qword ptr [rax+18h],rdi
                           00000000`4003e467 55              push    rbp
                           00000000`4003e468 4154            push    r12

you can also use windbg -z to disassemble a 64 bit binary in a 32 bit computer as shown below

C:\>cdb  -z "e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll"

Microsoft (R) Windows Debugger Version 10.0.15063.400 X86

ModLoad: 00000001`80000000 00000001`80626000   e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll

0:000> uf dbgeng!PopOutCtl
dbgeng!PopOutCtl:
00000001`80066160 4053            push    rbx
00000001`80066162 4883ec20        sub     rsp,20h
00000001`80066166 488bd9          mov     rbx,rcx
00000001`80066169 e8ba070000      call    dbgeng!FlushCallbacks (00000001`80066928)
00000001`8006616e 8b03            mov     eax,dword ptr [rbx]
00000001`80066170 890566a65300    mov     dword ptr [dbgeng!g_OutputControl (00000001`805a07dc)],eax
00000001`80066176 488b4308        mov     rax,qword ptr [rbx+8]
00000001`8006617a 4889057f575400  mov     qword ptr [dbgeng!g_OutputClient (00000001`805ab900)],rax
00000001`80066181 8b4310          mov     eax,dword ptr [rbx+10h]
00000001`80066184 89056e575400    mov     dword ptr [dbgeng!g_BufferOutput (00000001`805ab8f8)],eax
00000001`8006618a 8b4314          mov     eax,dword ptr [rbx+14h]
00000001`8006618d 890565a65300    mov     dword ptr [dbgeng!g_OutputWidth (00000001`805a07f8)],eax
00000001`80066193 488b4318        mov     rax,qword ptr [rbx+18h]
00000001`80066197 48890542da5400  mov     qword ptr [dbgeng!g_OutputLinePrefix (00000001`805b3be0)],rax
00000001`8006619e 4883c420        add     rsp,20h
00000001`800661a2 5b              pop     rbx
00000001`800661a3 c3              ret
0:000> 
| improve this answer | |
0

To add to many "No" responses: the latest "64 bit disassembler/IDA Pro" refers to the disassembler application itself - that it executes in 64 bit mode (a bit faster, and generally nicer to the OS, as they are all 64 bit there days). This has nothing to do with what code it can disassemble. The capabilities of the latest release are largely the same as previous, "32-bit" release. At least on the level of how most non-pros look at it.

64-bit IDA Pro will probably break all pre-compiled plugins, though, as they are all compiled in 32-bit mode. I haven't checked.

| improve this answer | |
-1

As answered by others, you don't need a specific build of IDA Pro to disassemble 64-bit code, there're many other alternatives. For example ScratchABit is free, open-source interactive disassembler which supports both 32-bit and 64-bit x86 code and is easily extensible to other architectures.

ScratchABit screenshot

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.