1

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend much time on what I might need to redo in the future.

I have experience in source code recovery and have recovered complete programs back to source, but I noticed that in many instances (in X86) when I didn't have a function completed, I was able to just use __asm {} for functions that weren't completed yet. Essentially, the process I used for recovering X86 programs was to convert them using IDA to pseudo C and then clean it up, restore structs and classes, throw it in Visual Studio and correct types and other things, but this process as you can tell is very painstaking.

Now, I am wanting to try restoring a X64 bit program and I see there is no inline assembly for X64 assembly in Visual Studio reference.

An approach that I am evaluating, is to have a system of inline assembly and then converting function by function from assembly to pseudo C and then correcting the pseudo C, structs, classes, et cetera. The functions which aren't completely recovered yet would be in asm {} and I am thinking that maybe since Visual Studio cannot use the x64 asm blocks, that it might be a safe idea to compile these uncompleted functions as assembly objects (.obj files) with another compiler then link them together with MSVC.

Another idea that I am currently evaluating is to use Intel compiler which supposedly can use inline X64 assembly and use Visual Studio as well.

The compiler is important, because often you want to use the same compiler as the authors used for recovery. I assume, though, that because the code will be assembly, the compiler here doesn't matter too strongly.

Is this a sound idea, would I not have to scrap it later?

Improve this question
5
  • you cannot use asm blocks inside a c/c++ source but that does not prevent you from making a asm file and assembling with ml64.exe and linking the object files together
    – blabb
    Feb 10, 2022 at 18:01
  • This is exactly what I wrote. I am curious if sane approach. Perhaps there are other approaches which should be evaluated.
    – LUser
    Feb 10, 2022 at 18:03
  • 1
    ok may be i glanced too fast when reading about the change to intel compiler. anyway here is an x64 asm mixed with c++ and vs answer i do not have the requisite experience to recommend other approaches
    – blabb
    Feb 10, 2022 at 18:15
  • What did you compile this with? It looks like ti was on Linux. On Linux , I don't see a particular problem with this, but in Windows I would like this.
    – LUser
    Jun 4 at 9:07
  • You mean the compilation in the link i pointed ? The answer has details about the compilation procedure using. Msvc cl.exe and ml64.exe. on windows there is no linux involved i dont see how you arrived at that opinion
    – blabb
    Jun 4 at 12:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.