Know a good disassembler?

enhzflep

Like Richard said, Olly Debugger is a great piece of work. You could also look at WDasm32[EDIT: W32Dasm] or IDA Pro. IDA has a plug-in module that will decompile code back into C source. It's a 2grand plugin that still seems like it should cost more. There's also a number of programs available for things coded in languages other than C. You can find VB Decompiler in both Pro & Lite versions, also there's "Delphi and C++ Decompiler" You should also be able to find links around for a copy of Sourcer, though I don't recall them having a trial copy.

modified on Sunday, July 13, 2008 4:27 PM

Mladen Jankovic · modified on Sunday, July 13, 2008 4:27 PM

enhzflep wrote:

WDasm32

It is w32dasm, actually. I second that.

[Genetic Algorithm Library]

leppie

I just saw they updated their tools and most of the issues I had are gone now :) Now to figure out how to utilize it :rolleyes:

xacc.ide - now with TabsToSpaces support
IronScheme - 1.0 alpha 4a out now (29 May 2008)

DavidNohejl

Nah sorry, nothing helpful.

[My Blog]
"Visual studio desperately needs some performance improvements. It is sometimes almost as slow as eclipse." - Rüdiger Klaehn
"Real men use mspaint for writing code and notepad for designing graphics." - Anna-Jayne Metcalfe

jacobjordan · modified on Sunday, July 13, 2008 4:27 PM

I've heard of IDA before. I just fould IDA Pro on Cnet, it says there it is $470.00. Are we talking about the same software?

if (your.Life == Lifestyles.Programming) { your = Cool; } else { your = !Cool; }

jacobjordan · modified on Sunday, July 13, 2008 4:27 PM

I have tried the Delphi & C++ decompiler, and it's a joke. I have also tried the lite version of the VB decompiler, and i wasn't impressed with that either.

if (your.Life == lifestyles.Programming) { your.Cool = true; } else { your.Cool = false; }

enhzflep

Dunno to be entirely honest. I find dial-up + CNET = me.frustrated, so I don't visit there. That price probably sounds about right for IDA. In case you didn't know, it's now developed by Hex-Rays, the maker of the $2000 plugin I mentioned before. If you visit IDA's homepage here: http://www.hex-rays.com/idapro/[^], you can download a free version that's still pretty bloody impressive. What's the target app compiled with? I may well have a better solution for you.

Anton Afanasyev

Hehe, Olly was always awesome :)

"impossible" is just an opinion.

DownUnderDev

http://www.hex-rays.com/idapro/[^] IDA Pro is gold, it even gives you the option of replacing code inside functions or even adding functions, which opens the door to a whole lot of nasty hacking fun. search for the 4.3 version that was still freeware

"Any intelligent fool can make things bigger, more complex, and more violent. It takes a touch of genius and a lot of courage to move in the opposite direction." -Albert Einstein

James Brown

IDA is the best. It's worth paying the price if you find yourself frequently needing to disassemble...

http://www.catch22.net

Gary R Wheeler

James Brown wrote:

if you find yourself frequently needing to disassemble

In 25+ years of professional software development across a wide variety of markets and a broad range of machines and operating systems, not once have I found a reason for using a disassembler. Unless you're a thief.

Software Zen: delete this;
Fold With Us![^]

Avi Cohen Stuart

I've been using IDA Pro some time now (at least 4 years) and I'm even more happier with the HexRay decompiler. It is worth every cent of it.

modified on Monday, July 14, 2008 10:24 AM

Kythen

There can be some very good reasons for using a disassembler, and not just for thievery. Personally, I've used the copy of IDA Pro I purchased to reverse engineer and understand some legacy Motorola 68k hardware, debug a flaky RS-485 card driver, and decipher what a number of vague error messages meant when returned by various win32 api calls. Also, think about what you would need if you were writing your own debugger or disassembler. I would think having a reference disassembler would be a very good idea. Disassemblers are tools that can certainly be misused, but one really shouldn't assume that will always be the case.

Fisa

The Reflector is the best .net disassembler. It shows you the code in C#, VB, C++.net and Delphi.net, and it has utilities (separate exe) to open resource files. You can download it at http://www.aisto.com/roeder/dotnet/[^]

James Brown

So what are you accusing me of exactly? Your claims of experience do not impress, there are many valid (legal) reasons for needing to use a disassembler. You simply need to broaden your horizons to find them

http://www.catch22.net

Lost User

There is, actually, it's called "ildasm", it disassembles MSIL bytecode to MSIL instructions

G7TNZ

The previous post just goes to show that however experienced one is there is always room to be able to learn. :) Part of our business is to rejuvenate legacy code owned by the client, where often they have lost the source and with it crucial parts of the business logic. Our ability to do this is based on our employees, some of whose first experience of computers was over 35 years ago, who are valued for their ability to disassemble and comprehend the original code which has often started life in the 60's.

Kythen

What type of program are you trying to disassemble, and what are you trying to accomplish by disassemblng it? IDA Pro is by far the best disassembler overall, but the free demo version is limited to x86 PE (Win32 .exe and .dll) files. If you can explain what you're trying to do, I can probably give you some better suggestions for tools.

enhzflep

:zzz: As a teenager 15 years ago, I taught myself asm with the aid of TurboDebugger & Sourcer. The internet was simply not available - yet alone heard of by me at the time. There was also precious little in the way of information around on specific tasks involving graphics - what the hell did all of those int 0x10 functions do anyway? What? Ask the guys at school. :scoffs: Easy, dissasemble the video bios and have a look at which IO ports were used to change the video mode to 0x13, or even more interesting, to mode X giving 240x200@256 cols & 4 planes. It wasn't until much later when I finished school and went to uni that I found myself like a kid in a candy store amongst the books in the computing library. Fast forward to today - how on earth do you think that Anti-Virus writers & vulnerability researchers at [insert company here] keep your precious little system choked full of 25 years of 'real' programming code safe? How do you think most SQL injection attacks are discovered and protected against? What about buffer overflow errors? You don't seriously think that people just sit there and try to overflow the buffer, without an insight into it's length :rolleyes: or the point at which data in the buffer begins to be (maliciously) executed. Of course, the AV writers must all be thieves. - Don't make me laugh. :laugh: Do yourself a favour Gary, and go and do some reading.

ScottM1

Try IDA Pro Freeware