30

To answer the first question. The biggest problem is that you can't really separate data from code. There are basically two approaches to dissasembly: Linear sweep Recursive traversal Dissasemblers using linear sweep start at some address and dissasemble instructions one by one until the end, without following jumps or reasoning about the dissasembled code ...


21

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


16

In addition to the issues described in the previous answers, here's another way in which a program can have more than one disassembly. Consider code that has the following logic (my apologies for the syntax-butchery): buf = ...some string... val = read() if (val == 7) {   mprotect(buf, ..., PROT_EXEC);    /* make buf executable */   ...


11

I think what the comment is meant to describe is the fact that on CISC, taking the x86 as an example here, there are several possible reasonable representations of the disassembly. But I'd think this can also in part be said of typical RISC implementations, where - however - the assembler can offer something like a CISC-like mnemonic represented by a ...


10

Your question is very interesting, though, not really new. Many people already use what we call binary rewriting for profiling purposes. For example DynInst & MAQAO do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers ...


9

It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance ...


7

Build the module with debug symbols Load the module you built into IDA Pro and import the debug symbols Use BinDiff to port function names, etc. from the IDB of the module you built to the IDB of your target module


5

I compiled your program on Ubuntu 14.04 and put it on https://mega.co.nz/#!gdRRxRzZ!dw08GEHvXeTxXqurcpMLOxpXVjZa807TJN0PH60h4Rg; you might want to use that binary if you want to retrace the following steps, because if you don't have the exact version of the C compiler and libs, your binary might be different. The file is a zip that includes the original ...


5

The question here is what do you need? Do you need to be able to run this thing on 64bit and interact with it or is the objective to actually port it? Run it If you only needed to run it and we can assume the compatibility libraries (those allowing to run 32bit programs on 64bit) as a given, you could probably intercept all kinds of functionality using the ...


5

Even if it's not in the question, as it would be quite hard to actually reassemble, I hope you can try something else than reassembling, or that it's at least a small and non-obfuscated file. low level Reassembling would be very difficult: Tools: I can't think of a specific tool to help, beyond IDA and normal reverse engineering methods (I get similar ...


5

A critical issue in disassembly lies in precisely separating code from data in binary executables. To this end, you will need a static analysis that can precisely determine the targets of indirect jumps (jumps to addresses calculated at run-time). There are several examples of indirect jumps including switch target calculation and vtables in C++. That ...


4

By far, the established method for binary rewriting is dynamic rewriting where the binary is rewritten while being run on real inputs. Think of instrumentation tools like PIN, DynamoRIO and Dyninst and also binary translators like qemu. Static rewriting tools have a fundamental challenge compared to dynamic rewriting which is precise Control Flow Graph ...


4

Some systems use a simple executable format which is linked by combining the instructions and defined data contained in the processed assembly files, in a specified sequence; the linker will apply address fix-ups, but otherwise the contents of the output executable will be exactly what the programmer specified--nothing more; nothing less. The old MS-DOS ....


4

Looks like those are LOCAL definitions, perhaps defined in two places to allow slightly different versions to be used. They're not global functions, which would be constrained to only appear (or be defined) once. Perhaps defined in several files, statically, so they're only used (or scoped to) in that particular file. I don't see those functions in the ...


4

I wouldn't go that far and state that the output provided by objdump isn't correct. True, Linear Sweep doesn't handle data properly, and jump tables & shellcodes are usually a source of disassembly errors. But still, this isn't an error. If you take a closer look at your code you'll notice you have je. Meaning, the jump is taken only if the previous ...


4

I can't post comments for now, since I'm new on this forum I'm not sure I fully understand your level of understanding here. Do you know some basic stuff in reversing field ? If so, you should load your DLL in OllyDbg (for example) then click on Debug > Call DLL export to locate the API you're interested in. Then it's classic reversing session. ...


3

Use IDA Pro with pe_write.idc. There's a full walk-through here: http://resources.infosecinstitute.com/applied-cracking-byte-patching-ida-pro/


3

I think that what you call "jump into instructions" could be an anti-static analysis technique called disassembly desynchronization, which interleaves data bytes with code in order to confuse the disassembler. This technique and others are explained in chapter 21 (Obfuscated Code Analysis) of the IDA Pro book. Using IDA Pro you can obtain the correct ...


3

In fact, objdump use the linear sweep algorithm to disassemble executable files. It means that it disassembles instructions one after one. Like this: First it goes to the entry point and disassemble the first instruction (and get its size): 4028c0: 41 57 push %r15 Then, knowing the size of the previous instruction, it updates the ...


3

If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing. Here's the gcc -S output of a typical prolog of a function compiled with -fPIC: call __i686.get_pc_thunk.bx addl $_GLOBAL_OFFSET_TABLE_, %ebx leal .LC0@GOTOFF(%ebx), %eax movl %eax, (%esp) call puts@PLT As ...


3

The catch is to determine whether the image in question uses a "standard" C runtime library of sorts (glibc, musl, uclibc) or not. If it does, then you can grab the entry point address and match the code at that address against your collection of startup routines from those libraries and pinpoint the main() location as you'd know which call is the one ...


3

I started to answer to this in « Reversing ELF 64-bit LSB executable, x86-64 ,gdb », but this was focused only to AMD64. Indeed, the key is really to locate the __libc_start_main function and take its first argument as a pointer to the entry of the main function. The full description of this function is the following (from its manual page): ...


3

objdump -f exe_name exe_name: file format elf32-little architecture: UNKNOWN!, flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED start address 0x00306990 The start address mentioned above is the main entry point in the executable. You can also verify this using gdb (gdb) break *0x00306990 Normally, the start address is mapped to symbol _start, so you can ...


3

Coastermelt project: open source firmware for creatively repurposing BD-R drives from Micah Scott aka @scanlime. It contains 2 very interesting videos: https://vimeo.com/110257380 https://vimeo.com/111417458 Github code: https://github.com/scanlime/coastermelt/


2

Preliminary Remarks First of all, we need to agree on what does a correct disassembly of a binary program is. I would propose the following definition: A correct disassembly of a binary program will give the set of all the possible instructions that can be executed by the program whatever input it takes. Another way to state it would be to say that we ...


2

I'm afraid you're not too clear when you talk about "reusing" some part of a program. What exactly do you want to do? Load the original program into a debugger, then call just one single function of it? Extract a ranged of addresses and turn that into a new program? Or extract one function from the original program, possibly together with everything the ...


2

So I am thinking that, in the asm code disassembled from objdump, we should always find this : push addr call __libc_start_main and in a heuristical perspective, we can just consider the addr in the above code is the beginning addr of main function. Am I right? Is there any exception?


2

Use IDA Pro. This is exactly the tool you're asking for. For patching the binary, use the options under the menu Edit -> Patch.


2

old question, but I think I can answer a part of it why the name of symbol _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE modified to _ZTTSt14basic_ifstreamIcS I think you've just run into as terminal width limit. By default readelf limits output lines to 80 characters, you neeed to pass -W to disable it: -W --wide Allow output width to ...


Only top voted, non community-wiki answers of a minimum length are eligible