x86 Disassembly/Disassemblers and Decompilers
From Wikibooks, the open-content textbooks collection
Contents |
[edit] What is a Disassembler?
In essence, a disassembler is the exact opposite of an assembler. Where an assembler converts code written in an assembly language into binary machine code, a disassembler reverses the process and attempts to recreate the assembly code from the binary machine code.
Since most assembly languages have a one-to-one correspondence with underlying machine instructions, the process of disassembly is relatively straight-forward, and a basic disassembler can often be implemented simply by reading in bytes, and performing a table lookup. Of course, disassembly has its own problems and pitfalls, and they are covered later in this chapter.
Many disassemblers have the option to output assembly language instructions in Intel, AT&T, or (occasionally) HLA syntax. Examples in this book will use Intel and AT&T syntax interchangeably. We will typically not use HLA syntax for code examples, but that may change in the future.
[edit] x86 Disassemblers
Here we are going to list some commonly available disassembler tools. Notice that there are professional disassemblers (which cost money for a license) and there are freeware/shareware disassemblers. Each disassembler will have different features, so it is up to you as the reader to determine which tools you prefer to use.
[edit] Commercial Windows Disassemblers
- IDA Pro
- is an professional disassembler that is expensive, extremely powerful, and has a whole slew of features. The downside to IDA Pro is that it costs $439 US for the standard single-user edition. As such, while it is certainly worth the price, this wikibook will not consider IDA Pro specifically because the price tag is exclusionary. Freeware versions do exist; see below.
- (version 5.2) http://www.hex-rays.com/idapro/
- PE Explorer
- is a disassembler that "focuses on ease of use, clarity and navigation." It isn't as feature-filled as IDA Pro, but carries a smaller price tag to offset the missing functionality: $130
- http://www.heaventools.com/PE_Explorer_disassembler.htm
- W32DASM
- W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003. the website went down and no replacement went up.
http://members.cox.net/w32dasm/(dead link)
[edit] Free Windows Disassemblers
- Objconv
- A command line disassembler supporting 16, 32, and 64 bit x86 code. Latest instruction set (SSE4, AVX, XOP, FMA, etc.), several object file formats, several assembly syntax dialects. Windows, Linux, BSD, Mac. Intelligent analysis.
- IDA 3.7
- A DOS GUI tool that behaves very much like IDA Pro, but is considerably more limited. It can disassemble code for the Z80, 6502, Intel 8051, Intel i860, and PDP-11 processors, as well as x86 instructions up to the 486.
- http://www.simtel.net/product.php (search for ida37fw)
- IDA Pro Freeware
- Behaves almost exactly like IDA Pro, but disassembles only Intel x86 opcodes and is Windows-only. It can disassemble instructions for those processors available as of 2003. Free for non-commercial use.
- (version 4.1) http://www.themel.com/idafree.zip
- (version 4.3) http://www.datarescue.be/idafreeware/freeida43.exe
- (version 4.9) http://www.hex-rays.com/idapro/idadownfreeware.htm
- BORG Disassembler
- BORG is an excellent Win32 Disassembler with GUI.
- http://www.caesum.com/
- HT Editor
- An analyzing disassembler for Intel x86 instructions. The latest version runs as a console GUI program on Windows, but there are versions compiled for Linux as well.
- http://hte.sourceforge.net/
- diStorm64
- diStorm is an open source highly optimized stream disassembler library for 80x86 and AMD64.
- http://ragestorm.net/distorm/
- crudasm
- crudasm is an open source disassembler with a variety of options. It is a work in progress and is bundled with a partial decompiler.
- http://code.google.com/p/vm64dec/downloads/list
- OllyDbg
- OllyDbg is one of the most popular disassemblers recently. It has a large community and a wide variety of plugins available. It emphasizes binary code analysis. Supports x86 instructions only (no x86_64 support).
- http://www.ollydbg.de/ (official website)
- http://www.openrce.org/downloads/browse/OllyDbg_Plugins (plugins)
[edit] Linux Disassemblers
- Bastard Disassembler
- The Bastard disassembler is a powerful, scriptable disassembler for Linux and FreeBSD.
- http://bastard.sourceforge.net/
- Objconv
- See above.
- ciasdis
- The official name of ciasdis is computer_intelligence_assembler_disassembler. This Forth-based tool allows to incrementally and interactively build knowledge about a code body. It is unique that all disassembled code can be re-assembled to the exact same code. Processors are 8080, 6809, 8086, 80386, Pentium I en DEC Alpha. A scripting facility aids in analyzing Elf and MSDOS headers and makes this tool extendable. The Pentium I ciasdis is available as a binary image, others are in source form, loadable onto lina Forth, available from the same site.
- http://home.hccnet.nl/a.w.m.van.der.horst/ciasdis.html
- objdump
- comes standard, and is typically used for general inspection of binaries. Pay attention to the relocation option and the dynamic symbol table option.
- gdb
- comes standard, as a debugger, but is very often used for disassembly. If you have loose hex dump data that you wish to disassemble, simply enter it (interactively) over top of something else or compile it into a program as a string like so: char foo[] = {0x90, 0xcd, 0x80, 0x90, 0xcc, 0xf1, 0x90};
- lida linux interactive disassembler
- an interactive disassembler with some special functions like a crypto analyzer. Displays string data references, does code flow analysis, and does not rely on objdump. Utilizes the Bastard disassembly library for decoding single opcodes. The project was started in 2004 and remains dormant to this day.
- http://lida.sourceforge.net
- dissy
- This program is a interactive disassembler that uses objdump.
- http://code.google.com/p/dissy/
- x86dis
- This program can be used to display binary streams such as the boot sector or other unstructured binary files.
- ldasm
- LDasm (Linux Disassembler) is a Perl/Tk-based GUI for objdump/binutils that tries to imitate the 'look and feel' of W32Dasm. It searches for cross-references (e.g. strings), converts the code from GAS to a MASM-like style, traces programs and much more. Comes along with PTrace, a process-flow-logger.
- http://www.feedface.com/projects/ldasm.html
[edit] Disassembler Issues
As we have alluded to before, there are a number of issues and difficulties associated with the disassembly process. The two most important difficulties are the division between code and data, and the loss of text information.
[edit] Separating Code from Data
Since data and instructions are all stored in an executable as binary data, the obvious question arises: how can a disassembler tell code from data? Is any given byte a variable, or part of an instruction?
The problem wouldn't be as difficult if data were limited to the .data section of an executable (explained in a later chapter) and if executable code was limited to the .code section of an executable, but this is often not the case. Data may be inserted directly into the code section (e.g. jump address tables, constant strings), and executable code may be stored in the data section (although new systems are working to prevent this for security reasons).
Many interactive disassemblers will give the user the option to render segments of code as either code or data, but non-interactive disassemblers will make the separation automatically. Disassemblers often will provide the instruction AND the corresponding hex data on the same line, to reduce the need for decisions to be made about the nature of the code. Some disassemblers (e.g. ciasdis) will allow you to specify rules about whether to disassemble as data or code and invent label names, based on the content of the object under scrutiny. Scripting your own "crawler" in this way is more efficient; for large programs interactive disassembling may be unpractical to the point of being unfeasible.
The general problem of separating code from data in arbitrary executable programs is equivalent to the halting problem. As a consequence, it is not possible to write a disassembler that will correctly separate code and data for all possible input programs. Reverse engineering is full of such theoretical limitations, although by Rice's theorem all interesting questions about program properties are undecidable (so compilers and many other tools that deal with programs in any form run into such limits as well). In practice a combination of interactive and automatic analysis and perseverance can handle all but programs specifically designed to thwart reverse engineering, like using encryption and decrypting code just prior to use, and moving code around in memory.
[edit] Lost Information
All text-based identifiers, such as variable names, label names, and macros are removed by the assembly process. They may still be present in generated object files, for use by tools like debuggers and relocating linkers, but the direct connection is lost and re-establishing that connection requires more than a mere disassembler. These identifiers, in addition to comments in the source file, help to make the code more readable to a human, and can also shed some clues on the purpose of the code. Without these comments and identifiers, it is harder to understand the purpose of the source code, and it can be difficult to determine the algorithm being used by that code. When you combine this problem with the possibility that the code you are trying to read may, in reality, be data (as outlined above), then it can be ever harder to determine what is going on.
[edit] Decompilers
Akin to Disassembly, Decompilers take the process a step further and actually try to reproduce the code in a high level language. Frequently, this high level language is C, because C is simple and primitive enough to facilitate the decompilation process. Decompilation does have its drawbacks, because lots of data and readability constructs are lost during the original compilation process, and they cannot be reproduced. Since the science of decompilation is still young, and results are "good" but not "great", this page will limit itself to a listing of decompilers, and a general (but brief) discussion of the possibilities of decompilation.
[edit] Decompilation: Is It Possible?
In the face of optimizing compilers, it is not uncommon to be asked "Is decompilation even possible?" To some degree, it usually is. Make no mistake, however: an optimizing compiler results in the irretrievable loss of information. An example is in-lining, a subroutine call is removed and the actual code is put in its place. A further optimization will combine that code with its surroundings, such that the places where the original subroutine is called are not even similar. An optimizer that reverses that process is comparable to an artificial intelligence program that recreates a poem in a different language. So perfectly operational decompilers are a long way off. At most, current Decompilers can be used as simply an aid for the reverse engineering process leaving lots of arduous work.
[edit] Common Decompilers
- DCC Decompiler
- Dcc is an excellent theoretical look at de-compilation, but currently it only supports small files.
- http://www.itee.uq.edu.au/~cristina/dcc.html
- Boomerang Decompiler Project
- Boomerang Decompiler is an attempt to make a powerful, retargetable compiler. So far, it only decompiles into C with moderate success.
- http://boomerang.sourceforge.net/
- Reverse Engineering Compiler (REC)
- REC is a powerful "decompiler" that decompiles native assembly code into a C-like code representation. The code is half-way between assembly and C, but it is much more readable than the pure assembly is. Unfortunately the program appears to be rather unstable.
- http://www.backerstreet.com/rec/rec.htm
- ExeToC
- ExeToC decompiler is an interactive decompiler that boasts pretty good results.
- http://sourceforge.net/projects/exetoc
