Difference between 32 bit and 64 bit disassemblers

Question

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly instructions, while a 64 bit disassembler also makes use of 64 bit instructions and registers.

My questions is, what are the advantages of using a 64 bit disassembler over a 32 bit disassembler?

Furthermore, if I want to disassemble a program compiled for a 64 bit machine, can I use a 32 bit disassembler like OllyDBG for that and what how would the output differ from a 64 bit disassembler like x64dbg?

Answer 1

There are no set definitions for "32-bit disassembler" and "64-bit disassembler". The terms are in fact ambiguous.

32-bit and 64-bit just refer to CPU architectures. Specifically to things such as register size and bus size. These can apply to many things.

Specifically, in the case of a disassembler, they can apply to two things:

1. The CPU architecture for which the disassembler binary is compiled
2. The CPU architecture which the disassembler is capable of disassembling.

Furthermore, there are multiple CPU families which come in both 32- and 64-bit flavours. The most relevant today are Intel & AMD, and ARM.

These are all independent. You could have a disassembler compiled to run on 32-bit Intel machines which is capable of disassembling binaries that are supposed to run on 64-bit ARM processors.

Now in the same CPU, a 64-bit architecture may or may not be an extension of a previous 32-bit architecture. This is the case with Intel.

So a 32-bit binary will typically be able to run on a 32-bit machine or a 64-bit machine, but a 64-bit binary will only be able to run on a 64-bit machine because it will use instructions, registers, addressing modes, etc than the 32-bit machine does not support.

Likewise if you try to disassemble a 64-bit binary using a disassember that is designed only to disassemble 32-bit binaries of the same CPU family, it will only recognize the 32-bit instructions, registers, addressing modes, etc. All of the 64-bit-specific stuff will just confuse the disassembler.

I'm not familiar with either OllyDBG or x64dbg so I don't know what they are capable of.

You seem to be under the impression that a "32 bit disassembler" will somehow convert or translate 64 bit code into 32 bit code. That is not possible. That would be in the realm of cross-compiling and emulation.

Answer 2

32 and 64 differ in another way than you think. You have pretty much the same binary code but on 64 you operate on 64-bit registers and 64-bit data. 32 and 64 are about data not code. Using OllyDBG on 64-bit code is ok, but:

• you have to take attention that you operating on 64-bit data.
  ie. when Olly shows MOV DWORD[PTR], EAX then really moves 8 bytes.
• one-byte instruction like INC EAX does not exist on 64-bit.
  when OllyDBG show one-byte i.e. INC EAX this is a 64-bit prefix.
  So: XOR EAX,EAX
  INC EAX
  JZ will run differently on 32 and 64
• probably much more issues