4 ms·

Interesting, but the objdump output is very primitive compared to more advanced disassemblers, which should be able to provide string cross-references etc in-li

by 0x0 15y ago

Interesting, but the objdump output is very primitive compared to more advanced disassemblers, which should be able to provide string cross-references etc in-line.

jdthomas 15y ago
Any particular disassembler(s) you recommend? How about on other architectures; MIPS or ARM?
- 0x0 15y ago
  Actually when I dabbled with disassemblers it was mostly on win32, where OllyDBG is nice. But IDA is probably the best you can get. Haven't had a look at the new versions, but even the freeware version is useful (on windows at least)
- angusgr 15y ago
  For free (as in beer) you can get IDA Pro 5.0 (an older version than the latest.) Not sure what architectures that version supports outside of x86 (the latest commercial version does ARM and the Advanced variant does MIPS.)
  - daeken 15y ago
    IDA Free has traditionally only supported x86 PE binaries, but I don't know if that's changed with the bump up to 5.0.
tedmielczarek 15y ago
Probably because writing disassemblers is a pain in the ass. (I have a half-finished x86 disassembler written in JavaScript: https://github.com/luser/disasmx86.js https://github.com/luser/disasmx86.js )
- mahmud 15y ago
  Not any disassembler, just x86 disassembly. The Opcode + Mod/Rm + SIB combinations is just insane.
burgerbrain 15y ago
Probably worth noting that you can use --disassembler-options=intel with objdump, if that's your thing. Makes it much nicer for me.
- mvanga 15y ago
  That is much better! I had to dig up the articles on the AT&T syntax to understand the plain objdump out but with this, that's no longer needed. I need to get to know my tools much more :)
  - burgerbrain 15y ago
    Yeah, I hate to think about how long I suffered used objdump before I thought to check the manpage for that. :)
mvanga 15y ago
I was actually trying to find a good one to use when first trying to be lazy but to no avail. A few friends also (unsuccessfully) tried in parallel to get the password and they were using IDA (http://www.hex-rays.com/idapro/ http://www.hex-rays.com/idapro/) but I have not personally tried it. It seems like a good option (although it is not open source, which irks me a little :P). I also tried to use an existing ASM-to-C decompiler called Boomerang (http://boomerang.sourceforge.net/license.php http://boomerang.sourceforge.net/license.php) but the output was a complete mess to understand (and compile). Maybe I'll try writing one of these when I'm bored on another lazy Friday :) Any other (preferably open) recommendations for Linux?
- bradfa 15y ago
  I didn't have much luck using Boomerang recently either. The REC decompiler (http://www.backerstreet.com/rec/rec.htm http://www.backerstreet.com/rec/rec.htm) isn't horrible. For simple stuff, it'll give you reasonable looking C-ish code. For anything slightly more complex, it may produce wrong code. It's not so good at eliminating duplicate variables, but manually removing them isn't hard, they're easy to see. I've recently been reversing a few stripped DLLs on Windows. REC worked well on the short functions but severely changed the logic of a few more complicated ones, especially doing bit shifts, concatenating bytes, and doing complex loops. I've seen IDA. I'd love to use it but it's expensive and I don't reverse engineer enough to justify asking for the company to buy it. That, and I'd also have to learn how to use it effectively, which would add time and possibly stunt me learning the basics first. Since I'm most certainly doing my work for commercial purposes, the demo / educational versions of IDA aren't usable for me (license agreement says so). EDIT: REC studio does not appear to be free (as in speech) software but it is free (as in beer) to use for most purposes and it runs on Windows / Linux / Mac.

by 0x0 15y ago

Interesting, but the objdump output is very primitive compared to more advanced disassemblers, which should be able to provide string cross-references etc in-line.

jdthomas 15y ago

Any particular disassembler(s) you recommend? How about on other architectures; MIPS or ARM?

0x0 15y ago
Actually when I dabbled with disassemblers it was mostly on win32, where OllyDBG is nice. But IDA is probably the best you can get. Haven't had a look at the new versions, but even the freeware version is useful (on windows at least)
angusgr 15y ago
For free (as in beer) you can get IDA Pro 5.0 (an older version than the latest.) Not sure what architectures that version supports outside of x86 (the latest commercial version does ARM and the Advanced variant does MIPS.)
- daeken 15y ago
  IDA Free has traditionally only supported x86 PE binaries, but I don't know if that's changed with the bump up to 5.0.

tedmielczarek 15y ago

Probably because writing disassemblers is a pain in the ass. (I have a half-finished x86 disassembler written in JavaScript: https://github.com/luser/disasmx86.js https://github.com/luser/disasmx86.js )

mahmud 15y ago
Not any disassembler, just x86 disassembly. The Opcode + Mod/Rm + SIB combinations is just insane.

burgerbrain 15y ago

Probably worth noting that you can use --disassembler-options=intel with objdump, if that's your thing. Makes it much nicer for me.

mvanga 15y ago
That is much better! I had to dig up the articles on the AT&T syntax to understand the plain objdump out but with this, that's no longer needed. I need to get to know my tools much more :)
- burgerbrain 15y ago
  Yeah, I hate to think about how long I suffered used objdump before I thought to check the manpage for that. :)

mvanga 15y ago

I was actually trying to find a good one to use when first trying to be lazy but to no avail. A few friends also (unsuccessfully) tried in parallel to get the password and they were using IDA (http://www.hex-rays.com/idapro/ http://www.hex-rays.com/idapro/) but I have not personally tried it. It seems like a good option (although it is not open source, which irks me a little :P). I also tried to use an existing ASM-to-C decompiler called Boomerang (http://boomerang.sourceforge.net/license.php http://boomerang.sourceforge.net/license.php) but the output was a complete mess to understand (and compile). Maybe I'll try writing one of these when I'm bored on another lazy Friday :) Any other (preferably open) recommendations for Linux?

bradfa 15y ago
I didn't have much luck using Boomerang recently either. The REC decompiler (http://www.backerstreet.com/rec/rec.htm http://www.backerstreet.com/rec/rec.htm) isn't horrible. For simple stuff, it'll give you reasonable looking C-ish code. For anything slightly more complex, it may produce wrong code. It's not so good at eliminating duplicate variables, but manually removing them isn't hard, they're easy to see. I've recently been reversing a few stripped DLLs on Windows. REC worked well on the short functions but severely changed the logic of a few more complicated ones, especially doing bit shifts, concatenating bytes, and doing complex loops. I've seen IDA. I'd love to use it but it's expensive and I don't reverse engineer enough to justify asking for the company to buy it. That, and I'd also have to learn how to use it effectively, which would add time and possibly stunt me learning the basics first. Since I'm most certainly doing my work for commercial purposes, the demo / educational versions of IDA aren't usable for me (license agreement says so). EDIT: REC studio does not appear to be free (as in speech) software but it is free (as in beer) to use for most purposes and it runs on Windows / Linux / Mac.