Collaborative RCE Tool Library - Disassemblers (including sub-categories)

Tool Updated: BeaEngine

Wed, 04 Nov 2009 15:51:29 GMT

Listed in categories: X86 Disassembler Libraries

Most recent version:
3.1.0

Most recent release date:
November 4, 2009

Description:
BeaEngine is a library coded in C. It contains actually one function called "Disasm" which allows to disassemble any instruction from the intel instructions set for processors 32 bits and 64 bits. You can use this lib with following languages : C, Python, Delphi, masm32, masm64, GoAsm32, GoAsm64, Nasm, Fasm. You can use it in ring3 or ring0 because it doesn't use the windows API. Th package you can download here contains the lib, the source code under LPGL3 license and examples including headers for C programmers, masm, nasm, fasm ,GoAsm Python, Delphi ones.

Tool Updated: Radare

Wed, 04 Nov 2009 09:18:47 GMT

Listed in categories: .NET Disassemblers, Assemblers, Binary Diff Tools, Code Injection Tools, Debuggers, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, SysCall Monitoring Tools, Tracers

Most recent version:
1.4.1

Most recent release date:
November 3, 2009

Description:
<nowiki>The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc.

The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls.

The debugger and disassembler has a code analysis module for x86, mips, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary.

The toolchain provides assemblers and disasemblers for x86, arm, mips (Loongson2F), sparc, CSR, m68k, powerpc, msil and java.

The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so).

The debugger is mainly developed on linux and {Net

Tool Updated: Dotnet IL Editor (DILE)

Sun, 09 Aug 2009 13:13:28 GMT

Listed in categories: .NET Debuggers, .NET Disassemblers, .NET Executable Editors

Most recent version:
0.2.6

Most recent release date:
September 30, 2007

Description:
Dotnet IL Editor (DILE) is an editor program which helps modifying .NET assemblies. It is intended to be able to disassemble .NET assemblies, modify the IL code, recompile it and run inside a debugger.

Tool Updated: IDA Pro

Thu, 06 Aug 2009 16:22:01 GMT

Listed in categories: .NET Disassemblers, Disassemblers, IPhone Tools, Linux Debuggers, Linux Disassemblers, Mobile Platform Debuggers, Mobile Platform Disassemblers, Ring 3 Debuggers, Symbian Tools

Most recent version:
5.5

Most recent release date:
June 15, 2009

Description:
The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows or on Linux. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.

There is also a free (crippled) version available (IDA Pro Free). See its own entry in the library for more info.

As of January 7, 2007, the official IDA Pro website moved from the old URL (http://www.datarescue.com/idabase) to the one listed above.

Tool Updated: Hiew

Tue, 28 Jul 2009 04:40:07 GMT

Listed in categories: Disassemblers, Hex Editors, PE Executable Editors

Most recent version:
8.02

Most recent release date:
July 26, 2009

Description:
* view and edit files of any length in text, hex, and decode modes
* x86-64 disassembler & assembler
* physical & logical drive view & edit
* support for NE, LE, LX, PE, PE32+ and little-endian ELF executable formats
* support for Netware Loadable Modules like NLM, DSK, LAN,...
* following direct call/jmp instructions in any executable file with one touch
* pattern search in disassembler
* built-in simple 64bit decrypt/crypt system
* built-in powerful 64bit calculator
* block operations: read, write, fill, copy, move, insert, delete, crypt
* multifile search and replace
* keyboard macros
* unicode support
* Hiew Extrenal Module (HEM) support

Tool Updated: Reflector for .NET

Sun, 19 Jul 2009 04:59:56 GMT

Listed in categories: .NET Decompilers, .NET Disassemblers, Decompilers

Most recent version:
5.1.4.0

Most recent release date:
July 18, 2009

Description:
From website:

"Reflector is a very powerful class browser, explorer, analyzer and documentation viewer for .NET. Reflector allows to easily view, navigate, search, decompile and analyze .NET assemblies in C#, Visual Basic and IL."

This is one of the most powerful .NET decompilers that you can't buy - just download :)
Many of the popular commercial tools achieving the same goal "suddenly" got a boost when this masterpiece of work saw a daylights (and besides that those are commercial, still have hard time with obfuscators).

Just give it a try, it will last literally five minutes - load some well known assembly of yours, choose target .NET language (!) and let'em work. Then compare it with the original.

You'll surely not forget this one.

Tool Updated: PEBrowse Professional

Sat, 18 Jul 2009 23:05:32 GMT

Listed in categories: .NET Disassemblers, .NET Tools, COM Tools, Delphi Tools, Disassemblers, Exe Analyzers, Memory Dumpers

Most recent version:
10.0.1

Most recent release date:
July 12, 2009

Description:
PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others. (We have received reports that the software also works on other OSes, including Wine (!) and Windows CE.)

With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse. The information is organized in a convenient treeview index with the major divisions of the PE file displayed as nodes. In most cases selecting nodes will enable context-sensitive multiple view menu options, including binary dump, section detail, disassembly and structure options as well as displaying sub-items, such as optional header directory entries or exported functions, that can be found as part of a PE file unit. Several table displays, hex/ASCII equivalents, window messages and error codes, as well as a calculator and scratchpads are accessible from the main menu.

While the binary dump display offers various display options, e.g., BYTE, WORD, or DWORD alignment, the greatest value of PEBrowse comes when one disassembles an entry-point. An entry-point in PEBrowse is defined as:

* Module entry-point
* Exports (if any)
* Debug-symbols (if a valid PDB, i.e., program database file, is present)
* Imported API references
* Relocation addresses
* Internal functions/subroutines
* Any valid address inside of the module

Selecting and disassembling any number of these entry-points produces a versatile display rich in detail including upper/lowercase display, C/Pascal/Assembler suffix/prefixing, object code, color-coded statements, register usage highlighting, and jump/call target preview popups. Additional information, such as variable and function names, will also be present if one has access to a valid PDB file. Disassembly comes in two flavors: linear sweep (sequential disassembly from a starting address) and recursive traversal, aka, analysis mode (disassembly of all statements reachable by non-call statements - extended analysis disassembles all internal call statements as well). The latter mode also presents local variables with cross-referencing, highlighting, and renaming options. If one adds/changes variable name or adds comments to specific lines, these can be displayed in a session file which will record and save all currently opened displays.

PEBrowse Professional will decompile type library information either embedded inside of the binary as the resource "TYPELIB" or inside of individual type libraries, i.e., .TLB or .OLB files.

PEBrowse Professional also displays all metadata for .NET assemblies and displays IL (Intermediate Language) for .NET methods. It seamlessly handles mixed assemblies, i.e., those that contain both native and managed code.

Finally, PEBrowse can be employed as a file browse utility for any type of file with the restriction that the file must be small enough that it can be memory-mapped.

Tool Updated: PE Explorer

Sat, 18 Jul 2009 22:11:32 GMT

Listed in categories: Disassemblers, PE Executable Editors, Resource Editors

Most recent version:
1.99 R5 (silent update)

Most recent release date:
July 11, 2009

Description:
PE Explorer provides powerful tools for disassembly and inspection of unknown binaries, modifying the properties of executable files and customizing and translating their resources. Use this product to do reverse engineering, analyze the procedures and libraries an executable uses.

Features include:

* Working with PE files - exe, dll, sys, drv, bpl, dpl, cpl, ocx and more.
* The ability to open a broken or packed file in Safe mode.
* Support for custom plug-ins to perform any startup processing.
* Collecting the full information contained in the file header.
* Checksum computing and modification.
* Review and editing Data Directories.
* Review of all the sections and info about their location and size.
* Review of contents of section as Raw Data - up to 16 view windows.
* Extracting and deleting sections.
* Section header recalculation.
* Section Editor to modify and repair the damaged section headers.
* Resource Editor to view and modify almost any kind of resources.
* Saving changes to disk as a new file image.
* Full info on exported and imported functions. Review of contents of the base relocation table.
* Quick Function Syntax Lookup. Syntax Description Editor.
* Source code and package information analyzer. Dependency Scanner.
* Built-in Disassembler.
* Customize GUI elements of your favorite Windows programs
* Special support for Delphi applications
* Automatic UPX and Upack unpacking

See multiple screenshots at: http://www.heaventools.com/scrshots.htm

Tool Updated: Dedexer

Fri, 26 Jun 2009 04:01:54 GMT

Listed in categories: Mobile Platform Disassemblers, Mobile Platform Tools, Needs New Category

Most recent version:
1.4

Most recent release date:
June 25, 2009

Description:
"Dedexer is a disassembler tool for DEX files. DEX is a format introduced by the creators of the Android platform. The format and the associated opcode set is in distant relationship with the Java class file format and Java bytecodes. Dedexer is able to read the DEX format and turn into an "assembly-like format". This format was largely influenced by the Jasmin syntax but contains Dalvik opcodes. For this reason, Jasmin is not able to compile the generated files."

Needs new category
This is a tool for Android dex files. There should be an Android tools category like the iPhone, Symbian, and Blackberry categories.

Tool Updated: Sourcer

Wed, 17 Jun 2009 11:46:05 GMT

Listed in categories: Disassemblers

Most recent version:
8.0

Most recent release date:
2001

Description:
Sourcer was a popular "commenting disassembler" back in the DOS day, trying to help your disassembling by adding informational comments to the disassembly.

Tool Updated: W32DASM

Wed, 17 Jun 2009 11:26:02 GMT

Listed in categories: Disassemblers, Ring 3 Debuggers

Most recent version:
8.94

Most recent release date:
March 11, 2003

Description:
Before IDA Pro, W32DASM was the king of Windows 32 bit executable disassemblers.

It also has a ring 3 debugger built-in.

Tool Updated: P32DASM

Sun, 14 Jun 2009 16:27:56 GMT

Listed in categories: Disassemblers, Visual Basic Decompilers

Most recent version:
2.5

Most recent release date:
June 14, 2009

Description:
P32Dasm is a Visual Basic 5.0/6.0 PCode + Native code Decompiler. It can generate String, Numbers, Objects, Import and Export function listing. There is also Jump calculator. For VB Native code executables are generated only MSVBVM, External calls and string references. Usefull for setting BPX, you don't need search in debugger where start some Command Button event. You can generate .map files, which you can import to DataRescue IDA (LoadMap plugin) or to Olly Debugger (MapConv plugin).

Tool Added: Nemo 440

Fri, 05 Jun 2009 21:17:54 GMT

Listed in categories: Flash Disassemblers

Most recent version:
1.0.5

Most recent release date:
January 21, 2009

Description:
Advanced ActionScript 3/ABC2/Flex 2/Flex 3/Flex 4/AIR disassembler.

To continue learning Flex/AIR, to better understand how Flash engine and undocumented Flex classes works, and for fun, Nemo 440 tool has been created. It's free ABC code diassembler implemented as AIR-based application. This is my first experience with AIR platform. Nemo 440 can read SWF files compiled with Flex 2/Flex 3/Flex 4 and translates ActionScript 3 byte code to more understandable text dump. Actually similar tool was created year or so before by other people, I only added minor changes and started connecting these ideas with user interface.

There are good programs like Flare and Flasm tools from Igor Kogan. Unfortunately with ActionScript 3/Flash 9/Flex 2 it doesn't work anymore.

With Flex 3 Adobe provides Java "swfutils.jar" tool to disassemble SWF content. Gordon Smith published good article describing this functionality: Disassembling a SWF with swfdump . Interesting fact that for early Flex 2 builds (around alpha version), we used similar tool located in "swfkit.jar", but it had problem with parsing runtime and for 30% of classes in other libraries. With Flex 2 Beta version it started to work worse. Sounds like now Adobe again reborned this tool. Hope it will work well in future.

Nemo 440 is free tool, USE IT AT YOUR OWN RISK, NO WARRANTIES ARE EXTENDED. It is not going to be commercial product in future. Ideally it would be nice to get something like Lutz Roeder's Reflector for .NET, disassembler, decompiler and more in one box, but for Flex. At this moment I am completely busy and probably won't do any good progress in these fields...

Nemo 440 can load files from URL via HTTP or from disk ("Open URL..."/"Open File..." commands accordingly). Supported binary formats are:

* Uncompressed SWF (*.swf),
* Compressed SWF (*.swf),
* ActionScript library (*.swc),
* Raw ABC2 byte code (*.abc).

Tool Updated: DotFuckScator v1.3

Sat, 09 May 2009 17:33:35 GMT

Listed in categories: .NET Disassemblers

Most recent version:
v1.3

Most recent release date:
May 9, 2009

Description:
DotFuckScator.V1.3

DotFuckScator is a reversing engineering tool used to remove string encryption
from dotfuscator protected files

If the original file was strong name signed DotFuckScator will create a new keypair
and re-sign the file with this pair, be carefull since file depending on this file will
need to be edited manualy to support the new strong name signature.
You can use RE-Sign for this and the editor of your choice

Also if you like the file re-signed with a specific key place your key in the same
folder as the file you are about to process and rename it to DotFuckScator.snk
now DotFuckScator will use this key for the re-sign process.

Hope this tool is of any use

Changes:
* v1.1 has a minor bugfix that prevented some strings from proper decrypting
* v1.2 small bugfix in re-signing, added indicator to show the amount of
strings decrypted so far
* v1.3 Fixed royal fuck-up in string decryption code replacement function
meaning the output will now run after string decryption removal ;x

Tool Updated: RosAsm

Wed, 15 Apr 2009 23:58:52 GMT

Listed in categories: Assembler IDE Tools, Assemblers, Debuggers, Disassemblers

Most recent version:
2.051a

Most recent release date:
April 15, 2009

Description:
Previously known as SpAsm.

The easy way for writing full 32 Bits Applications in Assembly

IDE with full integration of all components. RosAsm is auto-compilable and the Sources are hosted inside the PEs. No installation overhead (the silent auto-install coming with RosAsmFull.zip makes RosAsm the only actual Click&Go Assembler environment).

Real Sources Editor with tons of unique features, specificaly devoted to secure editions and to huge mono-files assembly sources: Tree-view, instant jump to any type of declaration by simple right-click, division of the mono-files into TITLEs, advanced IncIncluder pre-parser, and so on...

The fastest of the actual assemblers, (1.5 Mega/second on a Celeron 1.3 Ghz...) directly outputting PE files on a simple click, with a powerful macros system (a macros unfolder is available by a double-click, through a float menu). Simplified Intel syntax. Does not need any include, prototype or header companion file. Nothing but a single simple source. Complete implementation of the mnemonics set, up to SSE3. RosAsm Bottom-Up Assembler is a true low level Assembler, enabling HLL writing styles by user defined macros and/or by HLL pre-parsers selections.

Selectable Pre-Parsers performing various tasks, like HLL expressions parsing, alternate syntaxes, Includes Managements, ...

Source level Debugger with a state-of-the-art memory inspector and very advanced features, like the dynamic break-points, that can be set/removed by simple clicks, as well as at write-time and/or at run-time, like with the most advanced HLLs. To run the Debugger, You simply click on Run and your application is running through the debugger. Any error (or break-point, enabling advanced stepping modes) is pointed out directly in your source code. Accurate messages are delivered on errors cases.

Disassembler. To date, RosAsm is the one and only two-clicks-disassembler-reassembler ever seen. It is, actually, fully effective on most small files and on many middle size applications: The dream tool for study and/or for porting your works to assembly.

Original Resources Editors, with control of matching styles, outputting as well resources, files, and memory templates.

Integrated Help system, with a complete 32 bits Assembly Tutorials, Opcode help, and RosAsm Manual (2 megas of documentation, more than 600 organised rtf files).

Clip file system, for templates reuse.

Integrated OS Equates, and Structures files, saving from any boring include.

... and much more...

Take care that, as opposed to most RAD/IDEs, RosAsm does not attempt to impress you with multiple windows jumping all over the screen and with insistant features. Instead, RosAsm features implementations have always been made as discreet and as silent as possible, and the overall look-and-feel has always been made as naked and as simple as possible. Many implementations are optional, through the configuration tab.

Though RosAsm is the most accurate tool for learning the marvelous simplicity of Assembly - particulary since the inclusion of the Interactive Visual Tutorials - and though it is the easiest way to jump right into the true thing, it has been thought and designed, first, as a professional tool for real life applications programming in full assembly. Its final purpose is to compete with the current most commonly used HLLs, for serious applications writing. This goal will be achieved, in the near future, with the upcoming implementations of the Visual Components Designers (Wizards) and with the implementations of some Applications builders.

Tool Updated: Proview aka PVDasm

Wed, 01 Apr 2009 19:40:11 GMT

Listed in categories: Disassemblers

Most recent version:
1.7

Most recent release date:
March 31, 2009

Description:
The Proview (a.k.a PVDasm) Disassembler is Free, Interactive, Multi-CPU (Intel 80x86/ Chip8) that includes many features which allows the user to perform analysis on the target image file. PVDasm currently support image files of executable files (.exe), dynamic executable images (.dll) and Game-Boy image files (.gb/.gbc). Proview disassembler is being developed now for over 6 years and the work has never stopped (might be delayed) since than. PVDasm is always intended to be a free disassembler without any profits what so ever, this makes Proview different than the other disassemblers' out there.

PVDasm has been coded by me in 2002, history can shows that the first Proview engine was developed as a side project and was integrated as a part of a packer identifier which was also coded by me and was released in the name and version of Proview v0.8. Later that year this has changed, PVDasm disassembly engine has recoded from scratch with the aid of Intel x86 Books and the online opcode decoding tutorials and information of The-Svin as a project for my university. Proview disassembler disassembly engine does not use any 3rd party code or any other disassembler's code and operates by its own code. Currently the engine decodes the Intel 80x86 (32Bit) architecture (and hopefully later on will support the 64Bit architecture decoding) and support the different operation sets such as MMX/SSEx/3D Now! More than Intel, PVDasm also decodes the Chip8 CPU (and old CPU with minimal set of opcodes) which was used year back for gaming.
Support and Features in Proview Disassembler:

* Reads/Edits the PE (32Bit) / PE+ (64Bit) Image files.
* Integrated Hex Editor.
* Integrated Process Manager and Dumper.
* Source Code Generator and Wizard (Currently only for MASM Compiler).
* Plug-in SDK Architecture.
* Coloring Themes/Custom Themes for disassembly coloring.
* Function Parameters Recognition.
* Data/Function Entries Manger (Define your own data/code section).
* Produce PVDasm MAP and Support for IDA MAP Files (using ida2pv IDC script) for better analysis.
* First Pass analyzer (Simple Analyzer).
* Easy GUI Interface and features.
* Code Patcher (Edit image and apply changes on the fly).
* View/Search Function References and String References.
* View Call/Jxx Bodies without the need to trance (Hover on the address)
* Create and Load PVDasm Disassembly projects.
* Create And Execute Scripts using PVScript Engine.

There is both a Vista and a pre-Vista version available for download.

Tool Updated: Hacker Disassembler Engine (HDE)

Sat, 21 Mar 2009 19:59:17 GMT

Listed in categories: X86 Disassembler Libraries

Most recent version:
0.28

Most recent release date:
March 09, 2009

Description:
This is small disassembler engine intended to x86-32 code analyse. HDE get length of command, prefixes, ModR/M and SIB bytes, opcode, immediate value, displacement, etc. For example, you can use HDE when writing unpackers, decryptors, viruses of executable files. HDE package include compiled object files in difference formats, header files and assembler source.

* Supports FPU, MMX, SSE, SSE2, SSE3, 3DNow! instructions
* High speed and small size (~ 1.5 kb)
* Position and OS independent code
* Compatibility with a most coding languages

Tool Updated: Jclasslib

Wed, 04 Mar 2009 16:33:55 GMT

Listed in categories: Java Disassembler Libraries

Most recent version:
3.0

Most recent release date:
January 14, 2005

Description:
jclasslib bytecode viewer is a tool that visualizes all aspects of compiled Java class files and the contained bytecode. In addition, it contains a library that enables developers to read, modify and write Java class files and bytecode.

Tool Added: DisasmViewer

Sat, 03 Jan 2009 01:01:12 GMT

Listed in categories: Disassemblers

Most recent version:
0.1

Most recent release date:
December 12, 2008

Description:
DisasmViewer is a disassembler that use several disassembler libraries and assemblers. It converts binary codes to assembly codes. Support many options and can generate shell code from assembly code.

Tool Updated: Whiskey Kon Tequilla VB P-Code Debugger

Fri, 24 Oct 2008 20:11:51 GMT

Listed in categories: Disassemblers, Visual Basic Debuggers, Visual Basic Decompilers

Most recent version:
1.3e

Most recent release date:
Around 2001

Description:
Also known as "WKT Debugger".

At the time it showed up, the one and only P-Code disassembler / debugger mankind was able to use.

Before it, debugging of the P-Code (Runtime interpreted Pseudo-VB code) with ordinary disassemblers / debuggers was really pain in your neck. This one saved me a lot of time, and probably helped postpone my deportation to the psychiatric research facility.