52
Some other disassemblers / decompilers
W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003
Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI....
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
24
Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.
SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5).
Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...
17
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
15
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use ...
14
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...
13
010 Editor's Binary Templates feature is ideal for this type of work. It not only supports static struct definitions, but also allows for dynamically sized struct fields and supports a powerful scripting language.
12
Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".
R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the ...
10
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ARMv7-8, MIPS and 6502 architectures
Works on Linux, Mac OsX and Windows
Supports PE/COFF, ELF, .NES and Mach-O
Has python API
Has Undo
Has IL
Has a lot of ...
10
Given your requirements, you'd be much better off sticking with WinDbg.
OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need.
OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.
10
Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms.
A couple of features are available only in the Windows version:
WinDbg and Symbian debuggers
WinCE ...
9
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.
9
First, I'll answer your question straightly:
2nd column: The number of basic blocks in the function
3rd column: The size of the function (in bytes)
4th column: The function's name
You might have used "4th" to spot the number that comes after the "->". If this is the case, where there is a "->" the left number is the range of the function where on the right ...
8
Not a GUI tool, but FakeNet is a good alternative.
FakeNet is a tool that aids in the dynamic analysis of malicious
software. The tool simulates a network so that malware interacting
with a remote host continues to run allowing the analyst to observe
the malware’s network activity from within a safe environment. The
goal of the project is to:
- ...
7
ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and ...
7
Some plugins like reflexil provide this functionality.
7
A fat header is the header of a fat binary.
See pages 67-68 in Mac OS X Internals:
Note that a fat binary is essentially a wrapper—a simple archive that
concatenates Mach-O files for multiple architectures. A fat binary
begins with a fat header (struct fat_header) that contains a magic number followed by an integral value representing the number of ...
7
You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// protocols ;) All of them have a textual interface that should be suitable for braille-interfaces.
But I guess that the killer-feature of radare2 for blind people is ...
7
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.
netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every ...
6
I use Hex Workshop for this. It has a bunch of useful flat-file reversing features, but my favourite is that it lets you declare structures in C-style syntax and load them on top of a file. It's not free, but it's more than worth the $90 price tag.
Features I find most useful:
C-style struct syntax, supporting various arrays, string types, bitstrings, ...
6
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://sourceforge.net/projects/decompiler/
Use the following command with the command-line tool to decompile COM programs:
decompile --default-to ms-dos-com myprog....
5
BinNavi was just released as open source today by Google, so you can get it for free.
About using it with something else than REIL, if you're fearless, you can give a try to radare2, since it can translate its intermediary language ESIL, to REIL.
5
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
The bytecode in the example graph with its JUMP_IF_FALSE followed by some POP_TOPs and PRINT_NEWLINE instruction, reflect Python before 2.7.
However the ...
5
Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers:
FernFlower
Procyon
CFR
Krakatau
JD-GUI
5
I was searching for something similar and I found pfp! pfp is a python-based interpreter for 010 template scripts. Also take a look at the blog post.
5
Try C4Decompiler and REC Studio 4.
5
IDA Pro and a number of other disassemblers will disassemble your file, assuming that it isn't compressed or otherwise obfuscated. But this is only the first step in producing a working assembly language program, which you will need if you are to translate it into a higher language.
Essentially you are looking at two projects. The first is to produce a ...
5
you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image.
In very old binaries, this structure might be not used, or SecurityCookie RVA is 0 even though the binary may be using /GS. In such case you can scan for the characteristic code signature of the @__security_check_cookie@4 function:
...
5
The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter.
Regarding to the firmware, you cannot unpack the content using binwalk. To see why, check the start of the firmware. You will find a 0x20 bytes header starting with ...
5
At #SSTIC 2017, a french security conference, we will reveal a new solution :
https://www.sstic.org/2017/presentation/YaCo/
Last commit (in our private repo as of now...) was 5 minutes ago :-)
The YaCo plugin will be released along with its sources by the time of the talk.
Only top voted, non community-wiki answers of a minimum length are eligible