Batch disassembling DLL and EXE files?

Question

In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.

However, what I would preferably want is disassembling all of them and get the assembly files from all files in order to search through the code more "quickly". Even though I keep focusing on individual functions and files, I would otherwise need to decompile each DLL individually, which is a lot of repetitive work.

It's hard enough to find a proper x64 disassembler tool, let a long something that has command line options. Do you have any idea how to solve this problem?

Answer 1

If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you.

dumpbin /SECTION:.text /DISASM file.exe > file.txt

For more information, look at the MSDN documentation on dumpbin

Answer 2

Unix tools are your friends! You can disassemble all files by using a combination of Unix commands. These are easily available on Windows through Cygwin.

find $SYSTEMROOT -name \*.exe -or -name \*.dll -print0 |
xargs -0 -n 1 dumpbin /disasm 

The first command finds all .exe and .dll commands. The second applies dumpbin, which comes packaged with Visual Studio, on each found file name. You can redirect the output into a file, or you can modify the above sequence to write the output of each disassembled file into a different output file. You can also replace dumpbin with your favourite disassembler.

Answer 3

You can always write an IDAPython script that would:

1. Load a file using idc.LoadFile.
2. Wait for the auto-analysis to finish using ida_auto.auto_wait
3. Save the resulting IDB file by calling idc.save_database.

and then load the next file by calling idc.LoadFile again.

IMO, IDA's disassembler usually yields better results in comparison to the dumpbin utility.