52
Some other disassemblers / decompilers
W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003
Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI....
34
My apologies for the belated reply.
I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
24
Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.
SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).
Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...
20
You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.
19
Tools archived on http://www.woodmann.com/ should be safe.
I've personally met and trust most of the people who run the site (Woodmann, dELTA, etc.), and can vouch for their integrity.
18
As 0xea said, the .so file are just regular executable files but packed in a dynamic library style.
I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools.
Extract the functions from the library
A first step will be to extract the name of all ...
16
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
15
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use ...
14
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...
13
010 Editor's Binary Templates feature is ideal for this type of work. It not only supports static struct definitions, but also allows for dynamically sized struct fields and supports a powerful scripting language.
12
Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".
R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the ...
11
ArkDasm is a 64-bit interactive disassembler. Supported file types: PE64, raw binary files. Its currently in alpha stage but works well.
10
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ARMv7-8, MIPS and 6502 architectures
Works on Linux, Mac OsX and Windows
Supports PE/COFF, ELF, .NES and Mach-O
Has python API
Has Undo
Has IL
Has a lot of ...
10
Maynard is a (dis)assembler for Python byte code written by a member of Python core and the release manager for Python 3.4. Reading material here and here. I'm not aware of a public tool (besides the one you linked) that can do CFG visualization like that, but you certainly could build one on top of Maynard.
10
If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors
In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 6/26/13:
PE Explorer
...
10
Given your requirements, you'd be much better off sticking with WinDbg.
OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need.
OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.
10
Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms.
A couple of features are available only in the Windows version:
WinDbg and Symbian debuggers
WinCE ...
9
There are several tools dedicated to Python's bytecode reversing:
Uncompyle and Uncompyle2
'uncompyle' converts Python byte-code back into equivalent Python
source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed.
'uncompyle' may also verify the ...
9
This approach is commonly called "differential debugging". I know of the following tools that can help with it:
PaiMei from Pedram Amini
MyNav by Joxean Koret
IDA's trace replayer allows diffing two execution traces (also implemented by Joxean)
BinNavi has this feature
simple differ by @dionthegod
a script from Carlos Garcia which uses WinAppDbg framework ...
9
First, I'll answer your question straightly:
2nd column: The number of basic blocks in the function
3rd column: The size of the function (in bytes)
4th column: The function's name
You might have used "4th" to spot the number that comes after the "->". If this is the case, where there is a "->" the left number is the range of the function where on the right ...
8
ODA (the Online Disassembler) supports a myriad of architectures and provides a basic feature set. You can enter binary data in the Live View and watch the disassembly appear as you type, or you can upload a file to disassemble. A nice feature of this site is that you can share the link to the disassembly with others.
http://www.onlinedisassembler.com
8
I would also add
PEBrowse64 Professional
With the PEBrowse disassembler, one can open and examine any
executable without the need to have it loaded as part of an active
process with a debugger. Applications, system DLLs, device-drivers
and Microsoft .NET assemblies are all candidates for offline analysis
using either PEBrowse programs. The ...
8
Your best bet is Hachoir-Subfile. You can pass a file stream to Hachior-Subfile, it will search for all known embedded files and display the location. Some known formats it will calculate the size of the file. This makes it easy to carve out the files using dd. A helpful description of Hachoir-Subfile was left by one of the developers a couple weeks back in ...
8
I am using IDA for about 10 years and I have been using Hopper for a few months (on Kubuntu and Windows).
It depends what you want to do, what budget you have and whether it's hobby or professional.
Clearly, IDA is more powerful in most aspects. It supports a wider ranger of processors, has more loaders and a plugin system as well as two powerful scripting ...
8
Not a GUI tool, but FakeNet is a good alternative.
FakeNet is a tool that aids in the dynamic analysis of malicious
software. The tool simulates a network so that malware interacting
with a remote host continues to run allowing the analyst to observe
the malware’s network activity from within a safe environment. The
goal of the project is to:
- ...
8
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.
7
ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and ...
7
If your application is compiled to a binary you might still be able to use normal debuggers like IDA. However, Lua has its own tools for decompiling from machine code and byte code. These links should be kept up to date by the Lua community.
Lua Wiki: LuaTools
If you need support for Lua 5.2 LuaAssemblyTools is the first to support that.
7
There is also the option of tuts4you. They have an extensive download page there.
Only top voted, non community-wiki answers of a minimum length are eligible
