0

I have a binary file which is coded in assembly x86 and compiled with nasm. I used command

nasm file.asm -f bin -o file.bin

to compile it with nasm. I deleted the source code from disk long time ago, but now I need that.

Is there any way to reverse the binary file?

1
  • Can you share the bin file?
    – sudhackar
    Apr 16, 2022 at 13:57

1 Answer 1

2

According to nasmdoc the bin file doesn't have a definite structure. With a simple code like this

bits 32
default rel
section .rodata
x: db "foo", 0
pop eax
lea ebx, [x]
lea ebx, [y]
section .data
y: db "bar", 0

This in bin form assembles to

[/tmp] hd y.bin
00000000  66 6f 6f 00 58 8d 1d 00  00 00 00 8d 1d 14 00 00  |foo.X...........|
00000010  00 00 00 00 62 61 72 00                           |....bar.|
00000018

As you can see there's no definite structure in the output. If you know the architecture - 16(default)/32/64 you can directly load this file into something like IDA and with some interactive browsing around you can mark sections of this bin as code/data - this might take some time but IDA would recognize most of the code and you can dump the output to a simple asm file.

Update : Based on OPs link of the bin file

[rese] file file.bin
file.bin: DOS/MBR boot sector

This can be booted online - here Its a simple demo of writing colorful text to display. boot

Load it in IDA as 16-bit. It'll cleanly disassemble with comments. With some editing it'll be compatible to nasm

                 mov     ah, 7
                 mov     al, 0
                 mov     dh, 18h
                 mov     dl, 50h
                 int     10h             ; - VIDEO - SCROLL PAGE DOWN
                                         ; AL = number of lines to scroll window (0 = blank whole window)
                                         ; BH = attributes to be used on blanked lines
                                         ; CH,CL = row,column of upper left corner of window to scroll
                                         ; DH,DL = row,column of lower right corner of window
                 mov     ah, 1
                 mov     cx, 2607h
                 int     10h             ; - VIDEO - SET CURSOR CHARACTERISTICS
                                         ; CH bits 0-4 = start line for cursor in character cell
                                         ; bits 5-6 = blink attribute
                                         ; CL bits 0-4 = end line for cursor in character cell
                 mov     ah, 0
                 mov     al, 13h
                 int     10h             ; - VIDEO - SET VIDEO MODE
                                         ; AL = mode
                 mov     si, 7C3Ah
                 mov     cl, 28h ; '('

 loc_1C:                                 ; CODE XREF: sub_0+31↓j
                                         ; sub_0+38↓j
                 mov     ah, 0Eh
                 mov     al, [si]
                 mov     bh, 0
                 mov     bl, cl
                 int     10h             ; - VIDEO - WRITE CHARACTER AND ADVANCE CURSOR (TTY WRITE)
                                         ; AL = character, BH = display page (alpha modes)
                                         ; BL = foreground color (graphics modes)
                 lodsb
                 hlt
                 inc     cl
                 cmp     cl, 37h ; '7'
                 jz      short loc_36
                 cmp     al, 0
                 jnz     short loc_1C

 loc_33:                                 ; CODE XREF: sub_0+34↓j
                 hlt
                 jmp     short loc_33

 loc_36:                                 ; CODE XREF: sub_0+2D↑j
                 mov     cl, 20h ; ' '
                 jmp     short loc_1C
aYouJustBecameA :  db 'You just became a victim of wncry.',0xD,0xA,0xD,0xA
                db 'Enjoy the zzzz.',0
pad:            times 398 db 0
                db 0x55
                db 0xaa

which when assembled matches the original bin file.

[rese] nasm -f bin -o y.bin y.asm
[rese] diff <(hd file.bin) <(hd y.bin)
[rese] sha1sum y.bin file.bin
d6d77852628f51961b30dd3f7a8f07281fd87f5b  y.bin
d6d77852628f51961b30dd3f7a8f07281fd87f5b  file.bin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.