52 votes

Is there any disassembler to rival IDA Pro?

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 ...
user avatar
  • 5,850
35 votes

Objdump - How to output text (eg ASCII strings) alongside assembly code?

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -...
user avatar
  • 6,859
31 votes
Accepted

What is the linux equivalent to OllyDbg and Ida Pro?

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run ...
user avatar
24 votes

Is there any disassembler to rival IDA Pro?

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 ...
user avatar
14 votes

Is there any disassembler to rival IDA Pro?

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call ...
user avatar
  • 2,441
13 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
user avatar
  • 1,437
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
user avatar
  • 11.4k
10 votes

Is there any disassembler to rival IDA Pro?

Just for completeness: one more disassembler, Binary Ninja: As for now (9/26/2016) it has the following properties: Commercial ($99 as introductory price for personal use license) Handles x86, x64, ...
user avatar
  • 7,720
10 votes

Why there are not any disassemblers that can generate re-assemblable asm code?

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile ...
user avatar
  • 2,603
10 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
user avatar
9 votes
Accepted

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address. In order to specify that memory location precisely, the ...
user avatar
  • 4,511
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
user avatar
  • 2,826
8 votes
Accepted

Can AI be used to write better decompilers/disassemblers?

First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs ...
user avatar
  • 18.1k
7 votes

Is there any disassembler to rival IDA Pro?

ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ...
user avatar
  • 275
7 votes

What is the difference between static disassembly and dynamic disassembly?

I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static & dynamic. The definitions provided here come from this 2003 publication on code ...
user avatar
  • 2,603
7 votes
Accepted

What type of disassembler is distorm?

DiStorm does not implement recursive traversal, however you can use distorm (or others, e.g. capstone) to implement your own recursive traversal algortihm. There are a range of tools available doing ...
user avatar
  • 2,826
7 votes
Accepted

idapython - Get Xrefs to a stack variable

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
user avatar
6 votes
Accepted

How to find obfuscated hidden command line parameters?

those command line switches seems to be plainly visible in several languages kind:>kindlegen.exe -dont_append_source Info:I9018:option: -donotaddsource: Source files will not be added kind:>...
user avatar
  • 14.9k
6 votes
Accepted

Is it safe to load a virus to IDA Pro?

At first, it is always recommended to analyze viruses inside an Isolated environment. So, you could install IDA Pro in a Virtualized Environment such as VMWare Work Station and load the binary in IDA ...
user avatar
6 votes

idapython - Get Xrefs to a stack variable

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
user avatar
  • 11.4k
6 votes

Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?

No, you don't. Despite the name, "IDA Pro 64" allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).
user avatar
  • 34.7k
6 votes
Accepted

Why there are only 8 hexa memory digits while my RAM is 16G

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory ...
user avatar
5 votes

What is the linux equivalent to OllyDbg and Ida Pro?

I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
user avatar
  • 335
5 votes

Why there are not any disassemblers that can generate re-assemblable asm code?

By far, the established method for binary rewriting is dynamic rewriting where the binary is rewritten while being run on real inputs. Think of instrumentation tools like PIN, DynamoRIO and Dyninst ...
user avatar
  • 403
5 votes
Accepted

Getting past a whole lot of anti-debug measures for a windows exe

You can use something like Scylla Hide https://github.com/nihilus/ScyllaHide It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida. ...
user avatar
5 votes

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

One approach you might consider involves compiling different versions of metsrv.dll from source and then observing which ones are detected and which ones are not. For instance: Comment out half the ...
user avatar
  • 73
5 votes
Accepted

Can you change the architecture in Ghidra after importing?

you can right click the file you import at Active Project tab in ghidra main window, and select Set Language
user avatar
4 votes

Why there are not any disassemblers that can generate re-assemblable asm code?

Some systems use a simple executable format which is linked by combining the instructions and defined data contained in the processed assembly files, in a specified sequence; the linker will apply ...
user avatar
  • 161
4 votes

IDA SDK Extract Offset From Instruction

Elaborating on existing answers, if you prefer to use IDAPython: decode_insn(here()) print hex(cmd.Op1.addr)
user avatar
4 votes

What is the linux equivalent to OllyDbg and Ida Pro?

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
user avatar
  • 141

Only top scored, non community-wiki answers of a minimum length are eligible