52

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 Capstone Capstone is a lightweight multi-platform, multi-architecture disassembly framework. BORG Disassembler BORG is an excellent Win32 Disassembler with GUI....


34

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -dj .text <binary_name>. To examine hard-coded string data, use readelf -x .rodata <binary_name> Instructions and Data are located in separate areas ...


29

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run on Linux as well.


24

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5). Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...


22

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. and static analysis of a binary. Static program analysis is the analysis of computer software that is ...


14

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...


13

2 great disassemblers... lost in time. SPECIFICALLY for DOS and 16 bit programs. They were the IDA PRO of THEIR days... WCB (EXTREMELY rare to find. NEVER misses beginnings of a routine. NEVER) SOURCERER (IF you can find it. THE disassembler to go to when professionals wanted to disassemble any file. INDUSTRIAL strength, MORE OPTIONS that you can throw a ...


13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


10

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers ...


10

Just for completeness: one more disassembler, Binary Ninja: As for now (9/26/2016) it has the following properties: Commercial ($99 as introductory price for personal use license) Handles x86, x64, ARMv7-8, MIPS and 6502 architectures Works on Linux, Mac OsX and Windows Supports PE/COFF, ELF, .NES and Mach-O Has python API Has Undo Has IL Has a lot of ...


9

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis ...


9

One thing that's important to realize is that standard runtimes are commonly treated as any other code or library. How compiled code is linked and loaded depends a lot on the platform. .net is very different from c++. Basically functions have at least three major ways of showing up inside of your binary: Dynamically linked This when a function is kept ...


9

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger


9

The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address. In order to specify that memory location precisely, the CPU needs both the segment register and the address. In the absence of an explicit request (2E for CS, for example), or a mode which has an implicit override (...


8

You are looking at binary that is compiled as position-independent code. The call _i686_get_pc_thunk_bx and the following addition to ebx shows just that. If you take a look at the disassembly, you'll see that the address of the add ebx, 292Eh plus 0x292E will result in the first address of the GOT. That why in the next line, _dso_handle_ptr is addressed ...


8

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can find the exact definitions of the flags in IDC.IDC. A small excerpt: #define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte? #define isData(F) ...


8

First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs mimicking human reasoning", the reality is more about "automated heuristics to recognize patterns in tons of samples"... So, I will take the more accurate ...


7

ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and ...


7

I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static & dynamic. The definitions provided here come from this 2003 publication on code obfuscation : http://www.cs.arizona.edu/solar/papers/CCS2003.pdf Static disassembly is where the file being disassembled isn't executed during the course of ...


7

DiStorm does not implement recursive traversal, however you can use distorm (or others, e.g. capstone) to implement your own recursive traversal algortihm. There are a range of tools available doing something like this for you: IDA, BinaryNinja, JakStab (claims 'Iterative Disassembly') etc. Since retrieving the ControlFlowGraph is a hard problem, people ...


6

those command line switches seems to be plainly visible in several languages kind:>kindlegen.exe -dont_append_source Info:I9018:option: -donotaddsource: Source files will not be added kind:>strings -o kindlegen.exe | grep -i donotaddsource 5130184:option: -donotaddsource: Source files will not be added 5208360:Option: -donotaddsource: Quelldateien ...


6

At first, it is always recommended to analyze viruses inside an Isolated environment. So, you could install IDA Pro in a Virtualized Environment such as VMWare Work Station and load the binary in IDA Pro. IDA Pro by default will only perform disassembly of the binary. It means, static analysis or in other words, the code of the binary won't be executed. ...


6

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils.XrefsTo(sid) where sid is the frame id (retrieved using idc.GetFrame) should work, however I couldn't get it to yield any result in my attempts. Instead, ...


6

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, it requires a little bit of setup. You'll need to use a few functions to get what you need: get_func(ea): retrieves the func_t structure for the function at ...


6

No, you don't. Despite the name, "IDA Pro 64" allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).


6

Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system architecture and how many bits there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has virtual memory space covering possibly the entire address space but mapped to a limited section of physical memory. ...


5

there are no decent decompiler for 16b DOS afaik Dosbox has an integrated debugger, otherwise try TurboDebugger - and opening the file in IDA simultaneously to document on the go. Also check this recent blogpost about such a situation.


5

By far, the established method for binary rewriting is dynamic rewriting where the binary is rewritten while being run on real inputs. Think of instrumentation tools like PIN, DynamoRIO and Dyninst and also binary translators like qemu. Static rewriting tools have a fundamental challenge compared to dynamic rewriting which is precise Control Flow Graph ...


Only top voted, non community-wiki answers of a minimum length are eligible