I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code if you provide it a binary. However, I don't know how they differ in terms of mode of operationand I ask myself questions like "Why can a android/python code be decompiled but a C code be only disassembled?"

Can anyone give a precise difference between these 3 kinds of tools?

up vote 8 down vote accepted

These terms are currently defined on this site as follows:

Disassembler:

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Debugger:

Debuggers allow the user to view and change the running state of a program.

Decompiler:

Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language.

  • Ok. I at least understand a decompiler but I still don't understand difference between disassembler and debugger. I was seeing some of the tutorials on REing and find the guys stepping through the assembly code (in a disassembler). In that case, isn't the code code running? So how does this differ from a debugger? – Pervy Sage Jun 18 '14 at 19:23
  • 3
    A debugger contains a disassembler so that you can see the disassembled code through which you're stepping. However, not all disassembler tools contain live-debugging functionality. – Jason Geffner Jun 18 '14 at 19:29

I would like to add the following definition to avoid any doubts:

Decompilers are different from disassemblers in one very important aspect. While both generate human readable text, decompilers generate much higher level text, which is more concise and much easier to read.

Excerpted from official hex-rays doc

Conclusion, the decompilers alleviate both problems compared to disassemblers: their output is shorter and less repetitive.

  • A major difference, as yet unmentioned, between disassembling and decompiling is that disassembly is deterministic. Every machine code instruction disassembles to precisely one assembler instruction (I'll not mention the data/code dichotomy here, which is a kind of a Halting Problem). When decompiling, on the other hand, a single instruction may be translated into a number of expressions, and conversely, any number of instructions may be gathered into one high level expression – all at the discretion of the decompiler. Different decompilers may yield different results. – usr2564301 Dec 12 '16 at 15:05
  • If you are looking for a simple/simplistic answer: a Disassembler is a tool that transforms a binary to a low level language / mnemonic / assembly while a decompiler transforms the binary to (theoretically, or not...) its primary high level language used to code this binary. Meaning that not every binary could be decompiled but every binary could be disassembled. .NET assemblies and JAVA files for exemple once decompiled could be transformed to their original C#/Java code. – Soufiane Tahiri Dec 12 '16 at 15:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.