7

In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.

However, what I would preferably want is disassembling all of them and get the assembly files from all files in order to search through the code more "quickly". Even though I keep focusing on individual functions and files, I would otherwise need to decompile each DLL individually, which is a lot of repetitive work.

It's hard enough to find a proper x64 disassembler tool, let a long something that has command line options. Do you have any idea how to solve this problem?

0

3 Answers 3

8

If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you.

dumpbin /SECTION:.text /DISASM file.exe > file.txt

For more information, look at the MSDN documentation on dumpbin

2
  • This is amazing! Never knew there were built in tools in the VS tool chain for that. I will accept your answer and upvote both, as you have described the core issue most complete (how to decompile a file). I'll find a scripting solution then (cygwin, LINQPad, etc.)
    – bytecode77
    Dec 3, 2017 at 10:25
  • For anyone trying to find dumpbin, refer to this StackOverflow question. For me with VS 2019, I had to install "C++ profiling tools" as an individual component in the VS installer. Aug 6, 2021 at 19:39
5

Unix tools are your friends! You can disassemble all files by using a combination of Unix commands. These are easily available on Windows through Cygwin.

find $SYSTEMROOT -name \*.exe -or -name \*.dll -print0 |
xargs -0 -n 1 dumpbin /disasm 

The first command finds all .exe and .dll commands. The second applies dumpbin, which comes packaged with Visual Studio, on each found file name. You can redirect the output into a file, or you can modify the above sequence to write the output of each disassembled file into a different output file. You can also replace dumpbin with your favourite disassembler.

4
  • I don't see any package named "dumpbin". If "disasm" is a placeholder for any disassembler command line tool, then I would first need one. The real complexity for me is to find and use a proper tool. Having one would already be sufficient, as there are plenty of ways to invoke it, cygwin being only one of them.
    – bytecode77
    Dec 2, 2017 at 22:39
  • 3
    dumpbin is a Visual Studio tool
    – fpmurphy
    Dec 3, 2017 at 2:54
  • @DiomidisSpinellis: these days I'd always recommend all the basic tools included with Git for Windows. My main argument: it's a code-signed distribution.
    – 0xC0000022L
    Jun 17, 2018 at 20:04
  • @0xC0000022L I like that Cygwin through its package manager allows you to choose from hundreds of projects, thus allowing you to grow with it. Isn't Git for Windows restricting in this area? Jun 18, 2018 at 21:06
0

You can always write an IDAPython script that would:

  1. Load a file using idc.LoadFile.
  2. Wait for the auto-analysis to finish using ida_auto.auto_wait
  3. Save the resulting IDB file by calling idc.save_database.

and then load the next file by calling idc.LoadFile again.

IMO, IDA's disassembler usually yields better results in comparison to the dumpbin utility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.