You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers.
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Windows, Mac OS, and Linux.
Capabilities include disassembly, assembly, decompilation, graphing, and scripting,...
If you were looking for a contender, I believe ImmunityDebugger and OllyDbg can compete in part for dynamic-analysis and Hopper in part for static-analysis.
That said, there is a big gap between the capabilities you get with the aforementioned software and IDA.
IDA Pro is pretty unique with its capabilities and if you add the Hex-Rays Decompiler Plugin ...
Some other disassemblers / decompilers
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
BORG is an excellent Win32 Disassembler with GUI....
Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI.
Hopper and Radare2 run on Linux as well.
It is assumed here that Linux ELF32 binaries are being analyzed.
Code and data such as strings are stored in separate parts of ELF binaries.
To disassemble the parts containing code, use objdump -dj .text <binary_name>.
To examine hard-coded string data, use readelf -x .rodata <binary_name>
Instructions and Data are located in separate areas ...
Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.
SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).
Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...
Another framework to check out is Vdb and Vivisect
Vdb - Python based debugger and programatic debugging API
VdbTargetVMWare32 - Kernel debugging using the vmware hypervisor
VdbOnAndroid - Using vdb to debug android processes
Vivisect - Python based static analysis and emulation framework
Because this is really hard to do.
You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data.
When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...
This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle.
"Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?"
The compilation process is lossy.
At the machine ...
You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic
Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.
and static analysis of a binary.
Static program analysis is the analysis of computer software that is ...
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...
Here's a very simplified overview of how IDA does it:
add to the analysis queue all known entrypoints, or addresses specified by the user
while queue not empty, pop the next address
ask processor module to disassemble the instruction
ask processor module to analyze the instruction
processor module adds code cross-references to all possible targets
in the ...
On of my favorite alternatives to IDA is HT Editor.
I've used it on x86 and x64 binaries and java class files. I think it has support for many other architectures/bytecode. It is cross platform and has some nice features.
2 great disassemblers... lost in time. SPECIFICALLY for DOS and 16 bit programs. They were the IDA PRO of THEIR days...
WCB (EXTREMELY rare to find. NEVER misses beginnings of a routine. NEVER)
SOURCERER (IF you can find it. THE disassembler to go to when professionals wanted to disassemble any file. INDUSTRIAL strength, MORE OPTIONS that you can throw a ...
Slightly modified version from pydasm's README.txt
# Open, and read 200 bytes out of the file,
# while converting buffer to hex string
with open('file.bin','r') as f:
buffer = binascii.hexlify(f.read(200))
# Iterate through the buffer and disassemble
offset = 0
while offset < len(buffer):
i = pydasm.get_instruction(...
I have decided to post my answer not to overthrow Igor's answer, but to have an addition to it. I was not comfortable with editing his post either. I am pretty new to the forum and not sure how it is taken by other members.
There is a little theory I have recently learned, which I would like to share. Anyways, what I have taken in about IDA Pro from The ...
Your question is very interesting, though, not really new.
Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers ...
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ARMv7-8, MIPS and 6502 architectures
Works on Linux, Mac OsX and Windows
Supports PE/COFF, ELF, .NES and Mach-O
Has python API
Has a lot of ...
I have been using Hopper recently, and while it is not up to the level IDA is, it's really surprisingly sophisticated, particularly considering what it costs. Its main platform is OS X, but there are versions available for Linux and Windows as well. The OS X version also has some gdb integration, so you can use it as a debugger.
One thing that's important to realize is that standard runtimes are commonly treated as any other code or library. How compiled code is linked and loaded depends a lot on the platform. .net is very different from c++.
Basically functions have at least three major ways of showing up inside of your binary:
This when a function is kept ...
The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address.
In order to specify that memory location precisely, the CPU needs both the segment register and the address. In the absence of an explicit request (2E for CS, for example), or a mode which has an implicit override (...
As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64.
However, if you need something that will work on x86_64 take a look at ida-decompiler:
An IDA plugin that attempts to decompile a function. Written in Python. To try it in IDA, place your cursor on a function, and execute ...
ODA (the Online Disassembler) supports a myriad of architectures and provides a basic feature set. You can enter binary data in the Live View and watch the disassembly appear as you type, or you can upload a file to disassemble. A nice feature of this site is that you can share the link to the disassembly with others.
I would also add
With the PEBrowse disassembler, one can open and examine any
executable without the need to have it loaded as part of an active
process with a debugger. Applications, system DLLs, device-drivers
and Microsoft .NET assemblies are all candidates for offline analysis
using either PEBrowse programs. The ...
Have you checked out the open-source Metasm framework? It is a ruby framework for assembly manipulation, and can compete with IDA's static analysis capabilities. It has a graph view, can do disassembly/decompilation on x86/64, MIPS, and PPC and supports a couple of executable file formats.
I believe it has also been integrated into Metasploit.
You are looking at binary that is compiled as position-independent code. The call _i686_get_pc_thunk_bx and the following addition to ebx shows just that. If you take a look at the disassembly, you'll see that the address of the add ebx, 292Eh plus 0x292E will result in the first address of the GOT. That why in the next line, _dso_handle_ptr is addressed ...