3

currently I am trying to use IDA pro to generate assembly code from PE file and recompile it.

Firstly

basically I know this way:

File -> Produce File -> Create ASM File

and it seems the asm file it generated cannot be directly recompile.

Second

use some IDC or Python script in the IDA to extract useful asm instructions, put them together in order and recompile, this kind of solution can be seen from some academic paper, but non of them have given some detailed instructions about how to do this task...

Could anyone give me some instructions about this issue..? Thank you!

  • Be more specific what step you're failing on. What tools do you try to use to compile the ASM? What edits have to made to fixup the ASM, and what errors are thrown? – ixje Dec 17 '13 at 8:37
  • 3
    The ASM file produced by IDA is not meant for direct recompiling, you have to make several changes, by fixing up the addresses, resolving the imports etc.. – 0xec Dec 18 '13 at 4:43
  • @ExtremeCoders Hello, could you please tell me is there any solution dealing with the "change" issue..? It seems so complicated.. on 32 bit x86 windows platform... thank you! – lllllllllllll Dec 18 '13 at 15:09
  • The solution to dealing with the "change issue" is putting in effort yourself. This site is not here for doing the work for you, but for helping with problems you run into after you've shown to put in effort yourself. – ixje Dec 19 '13 at 6:09
6

Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: nasm dumper

0

I would answer the part

put them together in order and recompile

If your decompilation contains function chunks, be aware using an assembler that accept code outside from a function environment and be aware, too, with the data prevention execution.

For more information about function chunks: Chunked function (discontinuous chunks of code comprising a function)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.