52
Some other disassemblers / decompilers
W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003
Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI....
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
24
Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.
SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).
Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...
20
You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.
18
As 0xea said, the .so file are just regular executable files but packed in a dynamic library style.
I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools.
Extract the functions from the library
A first step will be to extract the name of all ...
17
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
15
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use ...
14
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...
13
010 Editor's Binary Templates feature is ideal for this type of work. It not only supports static struct definitions, but also allows for dynamically sized struct fields and supports a powerful scripting language.
12
Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".
R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the ...
11
ArkDasm is a 64-bit interactive disassembler. Supported file types: PE64, raw binary files. Its currently in alpha stage but works well.
10
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ARMv7-8, MIPS and 6502 architectures
Works on Linux, Mac OsX and Windows
Supports PE/COFF, ELF, .NES and Mach-O
Has python API
Has Undo
Has IL
Has a lot of ...
10
Given your requirements, you'd be much better off sticking with WinDbg.
OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need.
OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.
10
Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms.
A couple of features are available only in the Windows version:
WinDbg and Symbian debuggers
WinCE ...
9
There are several tools dedicated to Python's bytecode reversing:
Uncompyle and Uncompyle2
'uncompyle' converts Python byte-code back into equivalent Python
source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed.
'uncompyle' may also verify the ...
9
First, I'll answer your question straightly:
2nd column: The number of basic blocks in the function
3rd column: The size of the function (in bytes)
4th column: The function's name
You might have used "4th" to spot the number that comes after the "->". If this is the case, where there is a "->" the left number is the range of the function where on the right ...
8
ODA (the Online Disassembler) supports a myriad of architectures and provides a basic feature set. You can enter binary data in the Live View and watch the disassembly appear as you type, or you can upload a file to disassemble. A nice feature of this site is that you can share the link to the disassembly with others.
http://www.onlinedisassembler.com
8
I would also add
PEBrowse64 Professional
With the PEBrowse disassembler, one can open and examine any
executable without the need to have it loaded as part of an active
process with a debugger. Applications, system DLLs, device-drivers
and Microsoft .NET assemblies are all candidates for offline analysis
using either PEBrowse programs. The ...
8
Not a GUI tool, but FakeNet is a good alternative.
FakeNet is a tool that aids in the dynamic analysis of malicious
software. The tool simulates a network so that malware interacting
with a remote host continues to run allowing the analyst to observe
the malware’s network activity from within a safe environment. The
goal of the project is to:
- ...
8
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.
7
ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and ...
7
Some plugins like reflexil provide this functionality.
7
A fat header is the header of a fat binary.
See pages 67-68 in Mac OS X Internals:
Note that a fat binary is essentially a wrapper—a simple archive that
concatenates Mach-O files for multiple architectures. A fat binary
begins with a fat header (struct fat_header) that contains a magic number followed by an integral value representing the number of ...
7
You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// protocols ;) All of them have a textual interface that should be suitable for braille-interfaces.
But I guess that the killer-feature of radare2 for blind people is ...
7
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.
netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every ...
6
I'm a big fan of the kdiff route because it's quick and clean . Note: I use diffing for writing signatures on malware. Most of the time I need a simple visual of the different instructions. If you need to dig deeper go the BinDiff or DarunGrim route as mentioned by Mick.
In order to use kdiff to diff the binaries you will need the disassembly output ...
6
It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.
Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but ...
6
Linux shared object files are ELFs too! Any decompiler that works on "regular" ELF files will work for SO files too.
That said, you can use IDA Pro to disassemble them as usual. If you have IDA Pro licence with Hex-rays decompiler, you can use that. If you don't have Hex-rays, you can try ida-decompiler plugin to get some results. It's open source, but is ...
6
If this a commercial device sold in United States, it must be FCC certified and so must have a label with the FCC ID mentioned somewhere. You can use this page to search for any documents FCC has on file for this device. They should mention the frequencies on which the device operates.
6
I use Hex Workshop for this. It has a bunch of useful flat-file reversing features, but my favourite is that it lets you declare structures in C-style syntax and load them on top of a file. It's not free, but it's more than worth the $90 price tag.
Features I find most useful:
C-style struct syntax, supporting various arrays, string types, bitstrings, ...
Only top voted, non community-wiki answers of a minimum length are eligible