4

currently I am trying to use IDA pro to generate assembly code from PE file and recompile it.

Firstly

basically I know this way:

File -> Produce File -> Create ASM File

and it seems the asm file it generated cannot be directly recompile.

Second

use some IDC or Python script in the IDA to extract useful asm instructions, put them together in order and recompile, this kind of solution can be seen from some academic paper, but non of them have given some detailed instructions about how to do this task...

Could anyone give me some instructions about this issue..? Thank you!

Improve this question
4
  • Be more specific what step you're failing on. What tools do you try to use to compile the ASM? What edits have to made to fixup the ASM, and what errors are thrown?
    – ixje
    Dec 17, 2013 at 8:37
  • 3
    The ASM file produced by IDA is not meant for direct recompiling, you have to make several changes, by fixing up the addresses, resolving the imports etc..
    – 0xec
    Dec 18, 2013 at 4:43
  • @ExtremeCoders Hello, could you please tell me is there any solution dealing with the "change" issue..? It seems so complicated.. on 32 bit x86 windows platform... thank you!
    – lllllllllllll
    Dec 18, 2013 at 15:09
  • The solution to dealing with the "change issue" is putting in effort yourself. This site is not here for doing the work for you, but for helping with problems you run into after you've shown to put in effort yourself.
    – ixje
    Dec 19, 2013 at 6:09

2 Answers 2

Reset to default
7

Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: nasm dumper

Improve this answer
0
0

I would answer the part

put them together in order and recompile

If your decompilation contains function chunks, be aware using an assembler that accept code outside from a function environment and be aware, too, with the data prevention execution.

For more information about function chunks: Chunked function (discontinuous chunks of code comprising a function)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.