3 ms·

Fantastic feature to show branches graphically in the margin as arrows. Blindingly obvious, but still saves a lot of mental effort in keeping addresses in your

by unwind 14y ago

Fantastic feature to show branches graphically in the margin as arrows. Blindingly obvious, but still saves a lot of mental effort in keeping addresses in your head. Haven't seen any "desktop disassembler" (that sounds furniture-related) do that.

borski 14y ago
IDA Pro shows branches/jumps as a graph, which I think is even better: http://www.hex-rays.com/products/ida/pix/5_plain_graph_view.gif http://www.hex-rays.com/products/ida/pix/5_plain_graph_view.... When not in graph mode, it'll show jump arrows in the margin: http://www.chip.de/ii/146940129_e98df3e41d.jpg http://www.chip.de/ii/146940129_e98df3e41d.jpg
- wladimir 14y ago
  IDA Pro is crazily expensive though, and probably not worth it unless you're doing reverse engineering / exploit finding for a living. For example it's a bit overkill for just looking at disassembly to see what code the compiler has written, which (I think) is the common use case of objdump.
  - anigbrowl 14y ago
    That's true, and it seems to bog down easily in my (limited) experience with it. Ollydbg is fast and free, and very navigable. http://www.ollydbg.de/ http://www.ollydbg.de/ Oh, it too has arrows. That's what I mean by navigable. 32 bit only though.
    - StavrosK 14y ago
      From my limited experience with OllyDbg, it was fantastic.
    - tptacek 14y ago
      Ollydbg has more or less given way to Immunity Debugger, which is what you should be checking out if that's the flavor of reversing tool you're after. I don't know a lot of people who use IDA as a debugger and like it. On the other hand, IDA's a better disassembler (and not just because it handles multiple architectures) than Olly. It's the industry standard for a good reason. Hopper.app is giving it a run for its money on x86 and ARM. Hopper is all I use now. I think it's ironic that people think IDA is too expensive; it's not expensive enough, given its total addressable market. IDA's prices are so low that they artificially depress the market for all reverse engineering tools, which anchor or orbit around IDA's price point. Hex-Rays is trying to break out of that with the decompiler, but then Hopper did a good-enough decompiler and bundled it into a $100 tool. Professionals that use IDA (a) rely on it heavily (b) can use the same version of IDA for years and years (c) routinely bill out over 250-300/hr and (d) number in the tens of thousands. It's an interesting business case study.
      - anigbrowl 14y ago
        Most interesting! I just do reversing for fun rather than profit, but Immunity and Hopper both look very impressive.
  - borski 14y ago
    Totally agree - I was just providing an example of a native disassembler that has indications of branching/jumps. I think OllyDbg does this too (at least the margin arrows).
  - tptacek 14y ago
    Check out Hopper.app.
gsg 14y ago
Agreed. I have a flaky emacs hack that colours labels to make it easier to correspond branch with target, but arrows are considerably nicer.
- chetanahuja 14y ago
  @gsg Would you mind sharing said emacs hack ;-)
  - gsg 14y ago
    Why not? It's a bit more limited than I thought at first, basically only suitable for the output of gcc -S (highlights labels that look like .Lxxx). https://gist.github.com/4546274 https://gist.github.com/4546274 There's no license or documentation, it's flaky and probably broken, etc. Do whatever you like with it.

by unwind 14y ago

borski 14y ago

IDA Pro shows branches/jumps as a graph, which I think is even better: http://www.hex-rays.com/products/ida/pix/5_plain_graph_view.gif http://www.hex-rays.com/products/ida/pix/5_plain_graph_view.... When not in graph mode, it'll show jump arrows in the margin: http://www.chip.de/ii/146940129_e98df3e41d.jpg http://www.chip.de/ii/146940129_e98df3e41d.jpg

wladimir 14y ago
IDA Pro is crazily expensive though, and probably not worth it unless you're doing reverse engineering / exploit finding for a living. For example it's a bit overkill for just looking at disassembly to see what code the compiler has written, which (I think) is the common use case of objdump.
- anigbrowl 14y ago
  That's true, and it seems to bog down easily in my (limited) experience with it. Ollydbg is fast and free, and very navigable. http://www.ollydbg.de/ http://www.ollydbg.de/ Oh, it too has arrows. That's what I mean by navigable. 32 bit only though.
  - StavrosK 14y ago
    From my limited experience with OllyDbg, it was fantastic.
  - tptacek 14y ago
    Ollydbg has more or less given way to Immunity Debugger, which is what you should be checking out if that's the flavor of reversing tool you're after. I don't know a lot of people who use IDA as a debugger and like it. On the other hand, IDA's a better disassembler (and not just because it handles multiple architectures) than Olly. It's the industry standard for a good reason. Hopper.app is giving it a run for its money on x86 and ARM. Hopper is all I use now. I think it's ironic that people think IDA is too expensive; it's not expensive enough, given its total addressable market. IDA's prices are so low that they artificially depress the market for all reverse engineering tools, which anchor or orbit around IDA's price point. Hex-Rays is trying to break out of that with the decompiler, but then Hopper did a good-enough decompiler and bundled it into a $100 tool. Professionals that use IDA (a) rely on it heavily (b) can use the same version of IDA for years and years (c) routinely bill out over 250-300/hr and (d) number in the tens of thousands. It's an interesting business case study.
    - anigbrowl 14y ago
      Most interesting! I just do reversing for fun rather than profit, but Immunity and Hopper both look very impressive.
- borski 14y ago
  Totally agree - I was just providing an example of a native disassembler that has indications of branching/jumps. I think OllyDbg does this too (at least the margin arrows).
- tptacek 14y ago
  Check out Hopper.app.

gsg 14y ago

Agreed. I have a flaky emacs hack that colours labels to make it easier to correspond branch with target, but arrows are considerably nicer.

chetanahuja 14y ago
@gsg Would you mind sharing said emacs hack ;-)
- gsg 14y ago
  Why not? It's a bit more limited than I thought at first, basically only suitable for the output of gcc -S (highlights labels that look like .Lxxx). https://gist.github.com/4546274 https://gist.github.com/4546274 There's no license or documentation, it's flaky and probably broken, etc. Do whatever you like with it.