Windows disassembler: looking for a tool...

Posted by SigTerm on Stack Overflow See other posts from Stack Overflow or by SigTerm
Published on 2010-05-07T06:38:02Z Indexed on 2010/05/07 10:38 UTC
Read the original article Hit count: 355

Filed under:

disassembling

|

beginner

|

Windows

Hello.

I'm looking for a (preferably free) tool that can produce "proper" disassembly listing from a (non-.NET) windows PE file (*.exe or *.dll).

Important requirement: it should be possible to run the listing through a windows assembler (nasm, masm or whatever) and get working exe again (not necessarily identical to original one, but it should behave in the same way).

Intended usage is adding new subroutines into existing code, when source is not available.

Ideally, tool should be able to detect function/segment boundaries, API calls, and generate proper labels for jumps (I can live without labels for loops/jumps, though, but function boundary detection would be nice), and keep program resources/segments in place.

I'm already aware of IdaPRO(not free), OllyDBG (useful for in-place hacking, doesn't generate disassembly listing, AFAIK), ndisasm (output isn't suitable for assembler), dumpbin (useful, but AFAIK, output isn't suitable for assembler) and "proxy dll" technique.

Ideas? Or maybe there is a book/tutorial that explains some kind of alternative approach?

© Stack Overflow or respective owner

Related posts about disassembling

Disassembling with python - no easy solution?

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm trying to create a python script that will disassemble a binary (a Windows exe to be precise) and analyze its code. I need the ability to take a certain buffer, and extract some sort of struct containing information about the instructions in it. I've worked with libdisasm in C before, and… >>> More
How is printf() implemented in c?

as seen on Stack Overflow - Search for 'Stack Overflow'
Disassembling printf doesn't give much info: (gdb) disas printf Dump of assembler code for function printf: 0x00401b38 <printf+0>: jmp *0x405130 0x00401b3e <printf+6>: nop 0x00401b3f <printf+7>: nop End of assembler dump. How is it implemented under the hood? Why disassembling… >>> More
What does * address(found in printf) mean in assembly?

as seen on Stack Overflow - Search for 'Stack Overflow'
Disassembling printf doesn't give much info: (gdb) disas printf Dump of assembler code for function printf: 0x00401b38 <printf+0>: jmp *0x405130 0x00401b3e <printf+6>: nop 0x00401b3f <printf+7>: nop End of assembler dump. (gdb) disas 0x405130 Dump of assembler code for function… >>> More
Why is a function executed from the same memory address each time?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm disassembling an executable: (gdb) disas main Dump of assembler code for function main: 0x004012d0 <main+0>: push %ebp 0x004012d1 <main+1>: mov %esp,%ebp ... Each time the memory address is the same:0x004012d0. Isn't the memory address to be dynamically assigned by the… >>> More
How is prinf() implemented in c?

as seen on Stack Overflow - Search for 'Stack Overflow'
Disassembling printf doesn't give much info: (gdb) disas printf Dump of assembler code for function printf: 0x00401b38 <printf+0>: jmp *0x405130 0x00401b3e <printf+6>: nop 0x00401b3f <printf+7>: nop End of assembler dump. How is it implemented under the hood? >>> More

Related posts about beginner

assembly registers beginner

as seen on Stack Overflow - Search for 'Stack Overflow'
So I've been getting into a bit of assembly lately and I'm a beginner so i was wondering if someone could clarify something. I take it every process has it's own set of registers, and each thread can modify these registers right?. How then do multiple threads use the same registers without causing… >>> More
Beginner learning assembly preserving esp after function calls

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm a beginner learning some assembly, when preserving the ESP register before a function call does it matter if you do it by adding or subtracting? hard to explain, consider the following mov esi, esp sub esp, 12 // on 32bit OS this would mean that there are 3 arguments to the function // push,… >>> More
I am a beginner to C and this is the dumbest question..Confused about getchar() function

as seen on Stack Overflow - Search for 'Stack Overflow'
Sorry if I am not supposed to post beginner level questions here..I am new to this site Please read the code below first I am confused about getchar() 's role in the following code.. I mean I know its helping me see the output window which will only be closed when I press enter key So getchar()… >>> More
Top 10 Reasons SQL Developer is Perfect for Oracle Beginners

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Learning new technologies can be daunting. If you’ve never used a Mac before, you’ll probably be a bit baffled at first. But, you’re probably at least coming from a desktop computing background (Windows), so you common frame of reference. But what if you’re just now learning… >>> More
Would you recommend Head First Programming for someone new?

as seen on Programmers - Search for 'Programmers'
My brother is just starting out college. He's studying the same thing I am here in Bolivia; Systems Engineer which is the equivalent of what a CS degree is in the US. Being his big brother and a programmer myself I really want to guide him and give him the right material to learn and become good… >>> More