274
You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers.
Ghidra
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Windows, Mac OS, and Linux.
Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along ...
164
Conventions used plus preliminary remarks
I am trimming the output of GDB for brevity since it usually shows the copyright and other information at the beginning of ever session. When I reproduce the output I'll start at the first (gdb) prompt line, or in case or auto-executed commands from the first genuine output line.
In order to distinguish commands ...
52
If you were looking for a contender, I believe ImmunityDebugger and OllyDbg can compete in part for dynamic-analysis and Hopper in part for static-analysis.
That said, there is a big gap between the capabilities you get with the aforementioned software and IDA.
IDA Pro is pretty unique with its capabilities and if you add the Hex-Rays Decompiler Plugin ...
50
Some other disassemblers / decompilers
W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003
Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI....
42
Index (shortened)
Gentle Intro - binary executable code, how does it look?
Why it is a hard task to compare binary executable code?
Conclusion
Solutions
TL;DR
TL;DWTR (too long, don't want to read): skip ahead to the section Why it is a hard task to compare binary executable code? if you feel comfortable with the basics around assembly and disassembly. ...
32
My apologies for the belated reply.
I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.
32
SoftICE is pretty much dead. If you're looking for the same look and feel you can always check out Syser or BugChecker. Haven't used them myself as I think most kernel level debugging now a days is done through remote debugging either via a VM or another machine on the network. The same type of person who would use SoftIce would probably use WinDbg today.
...
30
Sogeti's Origami framework comes with a GTK based GUI.
What is it?
origami is a Ruby framework designed to parse, analyze, and forge PDF
documents. This is NOT a PDF rendering library. It aims at providing a
scripting tool to generate and analyze malicious PDF files. As well,
it can be used to create on-the-fly customized PDFs, or to inject
(...
29
Unless I'm mistaken, it sounds like you are looking for a binary diffing tool. Some good options are below. These all require IDA Pro.
DarunGrim (open-source)
BinDiff (commercial)
eEye Binary Diffing Suite (use archive.org to download the installer)
25
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
24
Another framework to check out is Vdb and Vivisect
Vdb - Python based debugger and programatic debugging API
VdbTargetVMWare32 - Kernel debugging using the vmware hypervisor
VdbOnAndroid - Using vdb to debug android processes
Vivisect - Python based static analysis and emulation framework
24
Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.
SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).
Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...
23
Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, ...
22
signsrch by Luigi Auriemma has signatures for tables used in common compression libraries (zlib etc.).
It has been ported as plugins for ImmDbg and IDA.
He also has the offzip tool which tries to identify and unpack compressed streams inside a binary.
22
What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:
https://github.com/Mysterie/uncompyle2
It runs on Python 2.7 but supports decompiling 2.5 to 2.7.
Note that some commercial projects has been known to use modified Python interpreters. Modifications can ...
19
You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time.
In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications
Reverse proxy intercept communication ...
19
You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the radare toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.
19
Here are tricks you can use when packaging your python app with a custom interpreter.
Remap the opcodes for the interpreter
Encrypt the pyc files (the custom interpreter decrypts before importing)
Remove access to co_code in the interpreter (delete the reference to co_code in the code_memberlist array declaration in codeobject.c of the interpreter)
...
19
Tools archived on http://www.woodmann.com/ should be safe.
I've personally met and trust most of the people who run the site (Woodmann, dELTA, etc.), and can vouch for their integrity.
17
potential (but untested) suggestions:
CrowdRE
IDA Toolbag
BinCrowd
CollabREate
17
Just to expand on @ange's answer, IDA Toolbag is a lightweight solution for collaboration using their "Queues" feature. I have tested that it does work, and I believe it provides all the features you mentioned in your question.
17
It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as the LeCroy Voyager M3i. If you have a decent size budget and you only need USB 2.0, I would go for the Ellisys USB Explorer 200. If you want to replay and change ...
17
As 0xea said, the .so file are just regular executable files but packed in a dynamic library style.
I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools.
Extract the functions from the library
A first step will be to extract the name of all ...
16
In general, BinDiff in its current version as of this writing (4.x) works by matching attributes on the function level.
Basically, matching is divided into two phases: first initial matches are generated which are then refined in the drill down phase.
Initial Matches
First of all BinDiff associates a signature based on the following attributes to each ...
16
Explanation
The break on attach is due to the ntdll DbgUiRemoteBreakin and DbgBreakPoint functions being called. If you check the kernel32 DebugActiveProcess function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the CreateRemoteThread, CreateRemoteThreadEx, or ZwCreateThreadEx function depending on your OS.
So, i guess one way ...
15
from its feature page:
Multi-architecture and multi-platform
GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris
x86{16,32,64}, dalvik, avr, arm, java, powerpc, sparc, mips, bf, csr, m86k, msil, sh
pe{32,64}, [fat]mach0{32,64}, elf{32,64}, te, dex and java classes
Highly scriptable
Vala, Go, Python, Guile, Ruby, Perl, Lua, Java, ...
14
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
14
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...
13
There is a paper called "N-version Disassembly: Differential Testing of x86 Disassemblers" (PDF) by Roberto Paleari, Lorenzo Martignoni, Giampaolo Fresi Roglia, and Danilo Bruschi which compares several x86 disassemblers in a formal fashion.
To quote the papers abstract:
The output of a disassembler is used for many different purposes
(e.g., debugging ...
13
Maybe check out this IDA plugin.
After you locate the crypto functions, doing a cross-reference in IDA should allow you to see where the functions are called and likely the key is nearby. If you can set a break-point on those functions and see what is being passed in for the key, this, of course, would be the easiest way.
Only top voted, non community-wiki answers of a minimum length are eligible
