Questions tagged [disassemblers]

A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language.

Filter by
Sorted by
Tagged with
303
votes
16answers
353k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
30
votes
5answers
9k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
26
votes
5answers
42k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
26
votes
8answers
38k views

Decompiling a 1990 DOS application

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
18
votes
1answer
42k views

Objdump - How to output text (eg ASCII strings) alongside assembly code?

Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, ...
13
votes
2answers
6k views

What is the algorithm used in Recursive Traversal disassembly?

Disassembling binary code is a quite difficult topic, but for now only two (naive) algorithms seems to be broadly used in the tools. Linear Sweep: A basic algorithm taking all the section marked as ...
11
votes
3answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
7
votes
2answers
3k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
7
votes
2answers
883 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
6
votes
3answers
75k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
6
votes
4answers
2k views

Can AI be used to write better decompilers/disassemblers? [closed]

In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
6
votes
1answer
713 views

How to Make .text Section in Assembly Writeable for Win7-64 EXE

I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue ...
5
votes
2answers
7k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
5
votes
2answers
3k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
5
votes
1answer
1k views

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO: call ds:SetEvent // default setting call [ds:SetEvent] // Target Assembler set ...
5
votes
1answer
936 views

What type of disassembler is distorm?

In Alam you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers: The Linear Sweep technique starts from the ...
5
votes
1answer
442 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
5
votes
1answer
1k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
5
votes
2answers
270 views

What is the Sourcer syntax for defining data structures?

I am working with version 8 circa 2000 of Sourcer from V Communications. They no longer support it. I've long since lost the manual. There is a definition file that you edit as you discover the code ...
4
votes
2answers
2k views

Do disassemblers detect standard functions?

Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the #include line to the appropriate header file (such as stdio.h or even windows.h)? If not, ...
4
votes
1answer
2k views

Pydasm: Disassembling limited length executable shellcode

How to disassemble first 200 bytes of an executable code using pydasm library in Python? I want to know how to set size of buffer to disassemble it.
4
votes
2answers
647 views

Which version of assembly does OllyDbg disassemble binary to?

So I understand that there are many assemblers such as MASM, FASM, NASM, etc. But which version is the disassembler in OllyDbg and Cheat Engine?
4
votes
1answer
817 views

Is it safe to load a virus to IDA Pro?

In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?
4
votes
3answers
2k views

How does disassembler really work?

a simple portable executable file looks like : I'm wondering how a disassembler works to parse the .text...to produce assembly code ? Because the PE file in his raw format seems to be unusable and ...
4
votes
4answers
2k views

Identifying jump table of a switch statement

I'm using a linear disassembler (beaEngine), and whenever I get to a jump table section, I get an error (or an incorrect decode since beaEngine mistakenly thinks it is code). How can I recognize this ...
4
votes
0answers
189 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
3answers
2k views

Radare produces a bunch of `add byte [rax], al`, but why?

What does a bunch of add byte [rax], al mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this... 0x10064faf8 0000 ...
3
votes
5answers
5k views

How do you compare C source code with the corresponding binary's assembly in IDA Pro?

I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
3
votes
1answer
291 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
3
votes
5answers
5k views

Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?

My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused.
3
votes
2answers
2k views

How to find obfuscated hidden command line parameters?

The Amazon KindleGen command line app (Windows, macOS, Linux download links) has several undocumented command line parameters that I'm curious about. One of these hidden command line parameters is: -...
3
votes
2answers
1k views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
3
votes
1answer
125 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
3
votes
1answer
290 views

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge. I easily found the cmp instruction ...
3
votes
3answers
2k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
3
votes
1answer
332 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
3
votes
1answer
1k views

Limitations of capstone's disassembly capabilities compared to IDA

I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA. If yes, are those limitations inherent, i.e. a result of the different design/techniques ...
3
votes
2answers
908 views

Is there a tool to scan for code / functions that can account for different compilers?

I have a library DLL and a program that uses the library (statically; the DLL is separate). My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks ...
3
votes
1answer
69 views

x86 disassembly confusion regarding VESA functions

I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling. The VESA function to be called will be stored in a global variable, e.g. ...
3
votes
1answer
385 views

How does the 'graphic views' on Hopper Disassembler work?

I would like to understand better what is that information on "graphic views" at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section. Thanks.
3
votes
1answer
365 views

IDA Pro addresses of arguments

I am a newbie in reverse engineering and I was trying to understand this blog post: http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html At one point, the author says the following ...
3
votes
1answer
471 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
2
votes
1answer
1k views

What is the meaning of this code generated by IDA Pro?

Test platform is Linux 32 bit. I use IDA Pro to disassembly the basename from coreutils 8.5 compiled by gcc 4.6.3 Here is a code snippet generated by IDA Pro call ...
2
votes
2answers
2k views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
2
votes
1answer
1k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
2
votes
1answer
135 views

Can I step through a binary with IDA (eval version), reading registers step-wise?

I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)). I'm used ...
2
votes
2answers
1k views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
2
votes
3answers
1k views

Disassembler for batch/automated processing

I want to extract opcodes (MOV, ADD, ...etc) from binary files 'exe files' but as I want the process to be completely automated, I was looking for a free disassembler which can be easily integrated ...
2
votes
2answers
2k views

Initializing a struct in win32 assembly programming using MASM

I'm trying to create a demo program demonstrating struct(s) in MASM , I've written a code like this : struct1 struct first db ? second dw ? struct1 EndS .386 .model flat,stdcall option casemap:none ...
2
votes
1answer
488 views

Need to recover C++ code from binary of server and client

We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is ...