5

In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.

However, what I would preferably want is disassembling all of them and get the assembly files from all files in order to search through the code more "quickly". Even though I keep focusing on individual functions and files, I would otherwise need to decompile each DLL individually, which is a lot of repetitive work.

It's hard enough to find a proper x64 disassembler tool, let a long something that has command line options. Do you have any idea how to solve this problem?

migrated from security.stackexchange.com Dec 2 '17 at 17:40

This question came from our site for information security professionals.

4

If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you.

dumpbin /SECTION:.text /DISASM file.exe > file.txt

For more information, look at the MSDN documentation on dumpbin

  • This is amazing! Never knew there were built in tools in the VS tool chain for that. I will accept your answer and upvote both, as you have described the core issue most complete (how to decompile a file). I'll find a scripting solution then (cygwin, LINQPad, etc.) – bytecode77 Dec 3 '17 at 10:25
5

Unix tools are your friends! You can disassemble all files by using a combination of Unix commands. These are easily available on Windows through Cygwin.

find $SYSTEMROOT -name \*.exe -or -name \*.dll -print0 |
xargs -0 -n 1 dumpbin /disasm 

The first command finds all .exe and .dll commands. The second applies dumpbin, which comes packaged with Visual Studio, on each found file name. You can redirect the output into a file, or you can modify the above sequence to write the output of each disassembled file into a different output file. You can also replace dumpbin with your favourite disassembler.

  • I don't see any package named "dumpbin". If "disasm" is a placeholder for any disassembler command line tool, then I would first need one. The real complexity for me is to find and use a proper tool. Having one would already be sufficient, as there are plenty of ways to invoke it, cygwin being only one of them. – bytecode77 Dec 2 '17 at 22:39
  • 3
    dumpbin is a Visual Studio tool – fpmurphy Dec 3 '17 at 2:54
  • @DiomidisSpinellis: these days I'd always recommend all the basic tools included with Git for Windows. My main argument: it's a code-signed distribution. – 0xC0000022L Jun 17 '18 at 20:04
  • @0xC0000022L I like that Cygwin through its package manager allows you to choose from hundreds of projects, thus allowing you to grow with it. Isn't Git for Windows restricting in this area? – Diomidis Spinellis Jun 18 '18 at 21:06
0

You can always write an IDAPython script that would:

  1. Load a file using idc.LoadFile.
  2. Wait for the auto-analysis to finish using ida_auto.auto_wait
  3. Save the resulting IDB file by calling idc.save_database.

and then load the next file by calling idc.LoadFile again.

IMO, IDA's disassembler usually yields better results in comparison to the dumpbin utility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.