From Collaborative RCE Tool Library
Disassembler Libraries
| Tool name: | BeaEngine |
| ||
|---|---|---|---|---|
| Author: | Beatrix2004 | |||
| Website: | http://www.binary-reverser.org | |||
| Current version: | 2.3 | |||
| Last updated: | June 28, 2007 | |||
| Direct D/L link: | http://binary-reverser.org/tools/BeaEngine/index.php | |||
| License type: | X11 | |||
| Description: | (french) BeaEngine est une bibliothèque (library) que j’ai écrite en assembleur pour processeurs INTEL (avec masm32) qui permet de désassembler du code IA-32 ou EM64T en fournissant le mnémonic, le modrm, le sib, le regopcode et la taille de l’instruction. Cette bibliothèque est assez rapide et gère la totalité des opcodes INTEL. Cette lib est fournie avec les sources ainsi que quelques exemples d’utilisation. Elle est publiée sous licence X11. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | BCEL |
| ||
|---|---|---|---|---|
| Author: | The Apache Jakarta Project | |||
| Website: | http://jakarta.apache.org/bcel | |||
| Current version: | 5.2 | |||
| Last updated: | June 6, 2006 | |||
| Direct D/L link: | N/A | |||
| License type: | Free / Open Source | |||
| Description: | The Byte Code Engineering Library is intended to give users a convenient possibility to analyze, create, and manipulate (binary) Java class files (those ending with .class). Classes are represented by objects which contain all the symbolic information of the given class: methods, fields and byte code instructions, in particular. Such objects can be read from an existing file, be transformed by a program (e.g. a class loader at run-time) and dumped to a file again. An even more interesting application is the creation of classes from scratch at run-time. The Byte Code Engineering Library (BCEL) may be also useful if you want to learn about the Java Virtual Machine (JVM) and the format of Java .class files. BCEL contains a byte code verifier named JustIce, which usually gives you much better information about what's wrong with your code than the standard JVM message. BCEL is already being used successfully in several projects such as compilers, optimizers, obsfuscators, code generators and analysis tools. Unfortunately there hasn't been much development going on over the past few years. | |||
| Also listed in: | Java Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | diStorm64 x86-64 Disasm Lib |
| ||
|---|---|---|---|---|
| Author: | Gil Dabah & Co. | |||
| Website: | http://www.ragestorm.net/distorm | |||
| Current version: | 1.7.27 | |||
| Last updated: | December 10, 2007 | |||
| Direct D/L link: | http://www.ragestorm.net/distorm/dl.php?id=11 | |||
| License type: | BSD license | |||
| Description: | Cross platform x86, x64, MMX, SSE, SSE2, SSE3, SSE4 and soon SSE5 support with open opcode database support (tools available, carefully examine the whole page, you're looking for disops.zip, at the moment available at http://www.ragestorm.net/distorm/dl.php?id=13) 'nough said. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | DisasMSIL |
| ||
|---|---|---|---|---|
| Author: | Daniel Pistelli | |||
| Website: | http://ntcore.com/Files/disasmsil.htm | |||
| Current version: | 1.0 | |||
| Last updated: | April 30, 2008 | |||
| Direct D/L link: | http://ntcore.com/Files/disasmsil/DisasMSIL.zip | |||
| License type: | Free / Open source | |||
| Description: | DisasMSIL is a free/open disasm engine for the Microsoft Intermediate Language (MSIL). You can use it any context you wish. There are no license restrictions. The only thing I ask you to do is to send me your bug fixes (if any). Note: Don't rely on the ECMA specification (Partition III: Common Language Infrastructure), since it's incomplete. Some new opcodes were introduced with the .NET Framework 2.0. | |||
| Also listed in: | .NET Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Disasm32 |
| ||
|---|---|---|---|---|
| Author: | Russell Libby | |||
| Website: | http://users.adelphia.net/~rllibby/source.html | |||
| Current version: | ||||
| Last updated: | March 1, 2004 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free / Open Source | |||
| Description: | Delphi Disassembler Conversion of libdisasm 2.0. This is a Delphi conversion of the libdisasm project. The source code provides basic disassembly of Intel x86 instructions from a binary stream. The intent is to provide an easy to use disassembler class which can be called to disassemble instructions from memory. Disassembled information is in Intel syntax, as well as in an intermediate format which includes detailed instruction and operand type information. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Fixed OllyDbg Disasm DLL |
| ||
|---|---|---|---|---|
| Author: | CondZero | |||
| Website: | http://arteam.accessroot.com/releases.html | |||
| Current version: | 1.10 | |||
| Last updated: | April 9, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | An improved and fixed version of the already known disasm library (released by Oleh, Olly's author and part of the Olly's disasm engine). A little tool might help for your tools. This package includes source code of 32-bit Disassembler and 32-bit single line Assembler for 80x86-compatible processors. The source is a slightly stripped/modified version of code used in OllyDbg v1.10 and is well proven by its numerous users. The disasm.dll has been built using VS2005 VC 8.0 (special note: I had to make a couple modifications for errors during compilation in the source). To include in your program, make sure the disasm.lib file is in your project folder and the resultant disasm.dll in your executable folder. Be sure to add this to your source code: #pragma hdrstop #include "disasm.h" | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Hacker Disassembler Engine (HDE) |
| ||
|---|---|---|---|---|
| Author: | Veacheslav Patkov | |||
| Website: | N/A | |||
| Current version: | 0.09 | |||
| Last updated: | October 26, 2007 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | This is small disassembler engine intended to x86-32 code analyse. HDE get length of command, prefixes, ModR/M and SIB bytes, opcode, immediate value, displacement, etc. For example, you can use HDE when writing unpackers, decryptors, viruses of executable files. HDE package include compiled object files in difference formats, header files and assembler source. * Supports FPU, MMX, SSE, SSE2, SSE3, 3DNow! instructions * High speed and small size (660 bytes) * Position and OS independent code * Compatibility with a most coding languages | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | libdisasm |
| ||
|---|---|---|---|---|
| Author: | mammon_, ReZiDeNt, The Grugq, MO_K, a_p, fbj | |||
| Website: | http://bastard.sourceforge.net/libdisasm.html | |||
| Current version: | 0.23 | |||
| Last updated: | January 16, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free / Open Source | |||
| Description: | x86 Disassembler Library The libdisasm library provides basic disassembly of Intel x86 instructions from a binary stream. The intent is to provide an easy to use disassembler which can be called from any application; the disassembly can be produced in AT&T syntax and Intel syntax, as well as in an intermediate format which includes detailed instruction and operand type information. This disassembler is derived from libi386.so in the bastard project; as such it is x86 specific and will not be expanded to include other CPU architectures. Releases for libdisasm are generated automatically alongside releases of the bastard; it is not a standalone project, though it is a standalone library. The recent spate of objdump output analyzers has proven that many of the people [not necessarily programmers] interested in writing disassemblers have little knowledge of, or interest in, C programming; as a result, these "disassemblers" have been written in Perl. In order to address this audience, a HOWTO has been provided which demonstrates how to use the libdisasm opcode tables to implement a true disassembler using Perl. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | radare |
| ||
|---|---|---|---|---|
| Author: | pancake | |||
| Website: | http://radare.nopcode.org | |||
| Current version: | 0.9.3 | |||
| Last updated: | February 19, 2008 | |||
| Direct D/L link: | http://radare.nopcode.org/get/radare-0.9.3.tar.gz | |||
| License type: | GPL | |||
| Description: | The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc. The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls. The debugger and disassembler has a code analysis module for x86, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary. The toolchain provides assemblers and disasemblers for x86, arm and java. The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so). The debugger currently works on linux,*bsd x86-32 but it has initial support for x86-64 and linux-ARM, and w32 support is in mind too. But there are IO plugins for debugging windows and DOS applications via wine and dosemu. Initial gxemul support gives us the possibility to also debug ARM, MIPS, SPARC, .. binaries. There are some internal commands to handle memory maps, mount a syscall proxy, inject code, patch data, dump user data sections, step-back, syscall tracing, hardware DRx register manipulation, conditional watchpoints with expressions, signalling manipulation, syscall injection and very early threading support.. Data structures can be parsed with hand-written C programs called as extensions from radare. So the hexadecimal editor comes with a set of views for different bases and print formats like URL-encoding, binary, octal, shellcode, C string-like, which is really useful for developing shellcodes. There's a minimal GUI frontend written in C that interacts directly with an VTE running radare. But I plan to write a new native frontend written in Vala. Current development plugins are: * ewf: EnCase (R) forensic disk images * winedbg: WineDebugger interface ( winedbg://./program.exe ) * haret: Remotely read WindowsCE memory ( haret://host:port ) * ptrace: Debugs or attach to a process ( dbg://file or pid://PID ) * sysproxy: Connects to a remote syscallproxy server * remote: TCP IO ( listen://:port or connect://host:port ) * gdb: Debugs or attach to a process using gdb (gdb://file, gdb://PID, gdb://host:port) * w32: posix to native w32 api io * posix: plain posix file access The tools provided around the core are: * radare: command line hexadecimal editor with IO plugin extensions * rabin: get info from ELF/MZ/PE/CLASS files * rasc: shellcode generator and tester (outputs in raw, hexpairs or C) * bindiff: binary diffing utilities for raw files, binaries, data blocks, etc * xrefs: find crossed references on raw images for ppc, arm and x86 * hasher: calculate different algorithms over data blocks of a file or stream * rsc: command line helpers written in shellscript or perl * javasm: minimalistic java assembler/disassembler/classdumper * armasm: minimalistic arm assembler * xc: converts between multiple radix numeric bases FMI see the mailing list Have fun! | |||
| Also listed in: | Assemblers, Binary Diff Tools, Code Injection Tools, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, SysCall Monitoring Tools, Tracers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | SysDasm |
| ||
|---|---|---|---|---|
| Author: | Kayaker | |||
| Website: | http://rootkit.com/newsread.php?newsid=208 | |||
| Current version: | ||||
| Last updated: | October 26, 2007 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free / Open Source | |||
| Description: | Full-Text Disassembler DLL Export Module for Kernel Mode I use the source code of NDISASM, the Netwide Disassembler portion of NASM, compiled into a user mode DLL, for use in various reversing projects that incorporate a disassembler component. Recently I decided to recompile the code into a *kernel mode* DLL, to see what use might be made of it in a driver context. The result may be of interest to some, perhaps as a self contained full-text disassembly module for testing or development (i.e. "playing"), or simply as an example of creating and using kernel mode export drivers. The full-text disassembly module, SysDasm.sys, is created with a single export, which acts as a wrapper around the NDISASM internal disasm routine. This export-only driver is loaded from another driver, either by linking to it explicitly, or by loading it with ZwSetSystemInformation using the SystemLoadImage class. In this type of export module, the DriverEntry routine is never called but exists so the file is compiled correctly as a .sys driver. If you want to design such a Kernel Mode DLL with functional entry/exit routines, you can add PRIVATE exports declared as DllInitialize/DllUnload. For more on this see for example DLLs in Kernel Mode by Tim Roberts http://www.wd-3.com/archive/KernelDlls.htm The easiest way to use such a kernel mode DLL is to include its .LIB file when compiling the driver which will communicate with it, and to declare the functions you want to import with EXTERN_C DECLSPEC_IMPORT. When the driver is loaded by the system, this second module is loaded as a required kernel DLL and the functions can then be called directly by name. The DLL is unloaded by the system when the driver closes. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Udis86 |
| ||
|---|---|---|---|---|
| Author: | Vivek Mohan | |||
| Website: | http://udis86.sourceforge.net | |||
| Current version: | 1.6 | |||
| Last updated: | August 5, 2007 | |||
| Direct D/L link: | N/A | |||
| License type: | Free / Open Source | |||
| Description: | Udis86 is an easy-to-use minimalistic disassembler library (libudis86) for the x86 and AMD64 (x86-64) range of instruction set architectures. The primary intent of the design and development of udis86 is to aid software development projects that entail binary code analysis. 1. Full support for the x86 and x86-64 (AMD64) range of instruction set architectures. 2. Full support for all AMD-V, INTEL-VMX, MMX, SSE, SSE2, SSE3, FPU(x87), and AMD 3Dnow! instructions. 3. Supports 16bit, 32bit, and 64bit disassembly modes. 4. Generates output in AT&T or INTEL assembler language syntaxes. 5. Supports flexbile input methods: File, Buffer, and Hooks. 6. Thread-safe and Reentrant. 7. Clean and very easy-to-use API. 8. Builds on *nix systems, Win32, DJGPP (new), Standalone, etc. | |||
| Also listed in: | X86 Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
Subcategories
There are 3 subcategories to this category.
