Collaborative RCE Tool Library - Disassemblers (including sub-categories)

Tool Added: Pokas x86 Emulator for Generic Unpacking

Sun, 18 Jul 2010 16:32:01 GMT

Listed in categories: Assembler IDE Tools, Assemblers, Automated Unpackers, Debuggers, Disassembler Libraries, Disassemblers, OEP Finders, PE Executable Editors, Programming Libraries, Tracers, Unpacking Tools, Virtual Machines, X86 Disassembler Libraries, X86 Emulators, X86 Sandboxes

Most recent version:
1.0.0.0

Most recent release date:
July 18, 2010

Description:
Pokas x86 Emulator is an Application-Only emulator created for generic unpacking and testing the antivirus detection algorithms.
This Emulator has many features some of them are:
1. Has an assembler and a disassembler from and to mnemonics.
2. Support adding new APIs and adding the emulation function to them.
3. Support a very powerful debugger that has a parser that parses the condition you give and create a very fast native code that perform the check on this condition.
4. Support seh and support tib, teb, peb and peb_ldr_data.
5. It monitors all the memory writes and log up to 10 previous Eips and saves the last accessed and the last modified place in memory.
6. it support 6 APIs:GetModuleHandleA, LoadLibrayA, GetProcAddress, VirtualAlloc, VirtualFree and VirtualProtect.
7. With all of these it's FREE and open source.

It successfully emulates:
1. UPX
2. FSG
3. MEW
4. Aspack
5. PECompact
6. Morphine

But it does contain bugs and it still in the beta version. It surely will be fixed soon ith the help of your feedback.

It still doesn't support multithreading and doesn't support Linux ELF executables.
It's still working only on windows but the Linux version will be available soon.

you can download it from https://sourceforge.net/projects/x86emu/

AmrThabet
amr.thabet_*at*_student.alx.edu.eg

Tool Updated: BeaEngine

Fri, 07 May 2010 09:26:51 GMT

Listed in categories: Needs New Category, X86 Disassembler Libraries

Most recent version:
4.0

Most recent release date:
May 6, 2010

Description:
BeaEngine is a library coded in C. It contains actually one function called "Disasm" which allows to disassemble any instruction from the intel instructions set for processors 32 bits and 64 bits. You can use this lib with following languages : C, Python, Delphi, PureBasic, masm32, masm64, GoAsm32, GoAsm64, Nasm, Fasm. You can use it in ring3 or ring0 because it doesn't use the windows API. Th package you can download here contains the lib, the source code under LPGL3 license and examples including headers for C programmers, masm, nasm, fasm ,GoAsm Python, Delphi , PureBasic ones.

[REQUEST]
need new category : "X64 disassembler library" -> absolutely necessary - another suggestion : modify the name of the current category "X86 disassemblers libraries" -> "x86 - x64 disassemblers libraries" :)

Tool Updated: Opdis

Sun, 25 Apr 2010 23:11:42 GMT

Listed in categories: Disassembler Libraries, Disassemblers, X86 Disassembler Libraries

Most recent version:
1.0.1

Most recent release date:
April 19, 2010

Description:
Opdis is a wrapper for the libopcodes disassembler library distributed as part of GNU binutils. It extends the libopcodes library by offering linear and control-flow disassembly algorithms, instruction and operand objects that are suitable for analysis, and a command-line utility to perform disassembly on arbitrary locations in a file.

The Opdis project consists of the libopdis library and the opdis command-line utility.

Tool Updated: PE Explorer

Thu, 04 Mar 2010 18:40:33 GMT

Listed in categories: Disassemblers, PE Executable Editors, Resource Editors

Most recent version:
1.99 R6 (silent update)

Most recent release date:
October 14, 2009

Description:
PE Explorer provides powerful tools for disassembly and inspection of unknown binaries, modifying the properties of executable files and customizing and translating their resources. Use this product to do reverse engineering, analyze the procedures and libraries an executable uses.

Features include:

* Working with PE files - exe, dll, sys, drv, bpl, dpl, cpl, ocx and more.
* The ability to open a broken or packed file in Safe mode.
* Support for custom plug-ins to perform any startup processing.
* Collecting the full information contained in the file header.
* Checksum computing and modification.
* Review and editing Data Directories.
* Review of all the sections and info about their location and size.
* Review of contents of section as Raw Data - up to 16 view windows.
* Extracting and deleting sections.
* Section header recalculation.
* Section Editor to modify and repair the damaged section headers.
* Resource Editor to view and modify almost any kind of resources.
* Saving changes to disk as a new file image.
* Full info on exported and imported functions. Review of contents of the base relocation table.
* Quick Function Syntax Lookup. Syntax Description Editor.
* Source code and package information analyzer. Dependency Scanner.
* Built-in Disassembler.
* Customize GUI elements of your favorite Windows programs
* Special support for Delphi applications
* Automatic UPX and Upack unpacking

See multiple screenshots at: http://www.heaventools.com/scrshots.htm

Tool Updated: Udis86

Thu, 04 Mar 2010 18:01:11 GMT

Listed in categories: X86 Disassembler Libraries

Most recent version:
1.7

Most recent release date:
June 6, 2008

Description:
Udis86 is an easy-to-use minimalistic disassembler library (libudis86) for the x86 and AMD64 (x86-64) range of instruction set architectures. The primary intent of the design and development of udis86 is to aid software development projects that entail binary code analysis.

1. Full support for the x86 and x86-64 (AMD64) range of instruction set architectures.
2. Full support for all AMD-V, INTEL-VMX, MMX, SSE, SSE2, SSE3, FPU(x87), and AMD 3Dnow! instructions.
3. Supports 16bit, 32bit, and 64bit disassembly modes.
4. Generates output in AT&T or INTEL assembler language syntaxes.
5. Supports flexbile input methods: File, Buffer, and Hooks.
6. Thread-safe and Reentrant.
7. Clean and very easy-to-use API.
8. Builds on *nix systems, Win32, DJGPP (new), Standalone, etc.

Tool Updated: Radare

Thu, 04 Mar 2010 17:37:43 GMT

Listed in categories: .NET Disassemblers, Assemblers, Binary Diff Tools, Code Injection Tools, Debuggers, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, SysCall Monitoring Tools, Tracers

Most recent version:
1.5

Most recent release date:
December 13, 2009

Description:
<nowiki>The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc.

The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls.

The debugger and disassembler has a code analysis module for x86, mips, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary.

The toolchain provides assemblers and disasemblers for x86, arm, mips (Loongson2F), sparc, CSR, m68k, powerpc, msil and java.

The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so).

The debugger is mainly developed on linux and {Net

Tool Updated: Hiew

Thu, 04 Mar 2010 17:18:13 GMT

Listed in categories: Disassemblers, Hex Editors, PE Executable Editors

Most recent version:
8.10

Most recent release date:
February 24, 2010

Description:
* view and edit files of any length in text, hex, and decode modes
* x86-64 disassembler & assembler
* physical & logical drive view & edit
* support for NE, LE, LX, PE/PE32+ and little-endian ELF/ELF64 executable formats
* support for Netware Loadable Modules like NLM, DSK, LAN,...
* following direct call/jmp instructions in any executable file with one touch
* pattern search in disassembler
* built-in simple 64bit decrypt/crypt system
* built-in powerful 64bit calculator
* block operations: read, write, fill, copy, move, insert, delete, crypt
* multifile search and replace
* keyboard macros
* unicode support
* Hiew Extrenal Module (HEM) support
* ArmV6 disassembler

Tool Updated: Hackman Suite

Thu, 04 Mar 2010 16:51:03 GMT

Listed in categories: Disassemblers, Hex Editors

Most recent version:
9.03

Most recent release date:
July 2009

Description:
Description
Hackman Suite is a multi-module all purpose debugging tool. It includes a hex editor, a disassembler, a template editor, a hex calculator and other everyday useful tools to assist programmers and code testers with the most common tasks.

The Editor
With Hackman Hex Editor you can edit any type of file in your hard disk, even your hard disk itself or a process in memory. Data are presented in 6 different ways (modes): ASCII, Hex, Binary, Octal, Decimal and Custom mode. The editor comes with unlimited undo/redo with undo/redo lists, full clipboard control: cut, copy, paste, paste special, clear clipboard, highly sophisticated find and replace, unlimited watches and bookmarks and numerous conversion modes, including Java, C++, VB, ASCII, text and more.
You can always use the Patch Maker, the MS-DOS Executable Maker, Merger/Splitter and Checksums (CRC16/32, MD5, SHA1 and more) to check and / or manipulate files. Embedded cryptographic capabilities (Skipjack, NSA, RCA algorithms), support for macros, inline command bar, numerous plugins and external tools, configurable toolbar, shortcuts and menus, multilingual interface and online help consist a part of the features list.

The Disassembler
Hackman Disassembler 9.0 is an ultra fast multi processor disassembler, capable of disassembling code at a rate of 250 Kb/sec (PIII/900 MHz). The opcodes cover all x86 Intel and AMD architecture, starting at 8086 and ending at 3DNow! and Pentium 4 specific instructions. With Hackman Disassembler you have a multi-disassembling suite integrated into one program with a handy interface. Opcode sets are available for Intel 8086/80286/80386/80486 (*), Intel Pentium/Pro/MMX/II/III/P4 (*), AMD 3DNow! (*), 1802 (*), 6502/6510/8500/8502, 65816, 65C02/65SC02, 65CE02, Motorola 6800/6802/6808 (*), Motorola 6801/6803 (*), Motorola 6805/146805 (*), Hitachi 6809/6309, 8085, Zilog Z80, Gameboy CPU, Java Bytecode. Asterisk (*) denotes detailed online help availability.

The Template Editor
Hackman Template Editor is an ultra fast editor based on multi-format templates. The templates can be either simple structures or complicated layered formats. With Hackman Template Editor you have a powerful template based multipurpose editor integrated into one program with a handy interface.
Supported Formats are Characters, Hex, Binary, Octal, Decimal, 8, 16, 32 and 64 bit signed and unsigned numbers, Floating numbers, DOS and UNIX Date/Time among others. You can edit both files or disks (physical, logical, compact flash, smart media, etc) and of course you can construct your own templates to match your needs.

The Calculator
Hackman Calculator is a versatile scientific calculator that can operate in any mode (decimal, hex, binary and octal) up to 1024 bits. It is able to perform both signed and unsigned operations. From simple arithmetics to advanced logical or boolean operations, Hackman Calculator can provide you with fast and accurate results up to 1024 bits.

The Bundled Utilities
Hackman INI Editor is developed by Innovation Systems as an extension for Hackman Hex Editor. You can edit INI and INF files with the ease of a few clicks!
Hackman DIZ Editor is developed by Innovation Systems as an extension for Hackman Hex Editor. You can edit DIZ files which you can include in your distribution zip files.
Hackman Autorun Generator is developed by Innovation Systems as an extension for Hackman Hex Editor. You can create autorun.inf files that you can distribute in your application's CD-Rom.
Other tools include MP3 Tag Editor, Version Changer, Date Changer and more!

Tool Updated: Proview aka PVDasm

Sun, 21 Feb 2010 10:47:02 GMT

Listed in categories: Disassemblers

Most recent version:
1.7a

Most recent release date:
February 21, 2010

Description:
The Proview (a.k.a PVDasm) Disassembler is Free, Interactive, Multi-CPU (Intel 80x86/ Chip8) that includes many features which allows the user to perform analysis on the target image file. PVDasm currently support image files of executable files (.exe), dynamic executable images (.dll) and Game-Boy image files (.gb/.gbc). Proview disassembler is being developed now for over 6 years and the work has never stopped (might be delayed) since than. PVDasm is always intended to be a free disassembler without any profits what so ever, this makes Proview different than the other disassemblers' out there.

PVDasm has been coded by me in 2002, history can shows that the first Proview engine was developed as a side project and was integrated as a part of a packer identifier which was also coded by me and was released in the name and version of Proview v0.8. Later that year this has changed, PVDasm disassembly engine has recoded from scratch with the aid of Intel x86 Books and the online opcode decoding tutorials and information of The-Svin as a project for my university. Proview disassembler disassembly engine does not use any 3rd party code or any other disassembler's code and operates by its own code. Currently the engine decodes the Intel 80x86 (32Bit) architecture (and hopefully later on will support the 64Bit architecture decoding) and support the different operation sets such as MMX/SSEx/3D Now! More than Intel, PVDasm also decodes the Chip8 CPU (and old CPU with minimal set of opcodes) which was used year back for gaming.
Support and Features in Proview Disassembler:

* Reads/Edits the PE (32Bit) / PE+ (64Bit) Image files.
* Integrated Hex Editor.
* Integrated Process Manager and Dumper.
* Source Code Generator and Wizard (Currently only for MASM Compiler).
* Plug-in SDK Architecture.
* Coloring Themes/Custom Themes for disassembly coloring.
* Function Parameters Recognition.
* Data/Function Entries Manger (Define your own data/code section).
* Produce PVDasm MAP and Support for IDA MAP Files (using ida2pv IDC script) for better analysis.
* First Pass analyzer (Simple Analyzer).
* Easy GUI Interface and features.
* Code Patcher (Edit image and apply changes on the fly).
* View/Search Function References and String References.
* View Call/Jxx Bodies without the need to trance (Hover on the address)
* Create and Load PVDasm Disassembly projects.
* Create And Execute Scripts using PVScript Engine.

There is both a Vista and a pre-Vista version available for download.

21.02.2010:
Fixed a buffer accees violation bug in the PE Imports scanner, thanks SecMAM for the bug report.
Increased buffers size for extra caution.
Changed MoveWindow() to SetWindowPos() for better compability and speed.
Changed SetWindowLong to SetWindowLongPtr (32Bit/64Bit Compability) - thanks 'jstorme'.

Tool Updated: DynamoRIO

Tue, 09 Feb 2010 18:12:27 GMT

Listed in categories: Code Coverage Tools, Code Injection Tools, Debugger Libraries, Disassembler Libraries, Profiler Tools

Most recent version:
1.50.0.1

Most recent release date:
December 29, 2009

Description:
DynamoRIO is a runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling, instrumentation, optimization, translation, etc. Unlike many dynamic tool systems, DynamoRIO is not limited to insertion of callouts/trampolines and allows arbitrary modifications to application instructions via a powerful IA-32/AMD64 instruction manipulation library. DynamoRIO provides efficient, transparent, and comprehensive manipulation of unmodified applications running on stock operating systems (Windows or Linux) and commodity IA-32 and AMD64 hardware.

Previous description:

The DynamoRIO Collaboration - Dynamo from Hewlett-Packard Laboratories + RIO (Runtime Introspection and Optimization) from MIT's Laboratory for Computer Science.

The DynamoRIO dynamic code modification system, joint work between Hewlett-Packard and MIT, is being released as a binary package with an interface for both dynamic instrumentation and optimization. The system is based on Dynamo from Hewlett-Packard Laboratories. It operates on unmodified native binaries and requires no special hardware or operating system support. It is implemented for both IA-32 Windows and Linux, and is capable of running large desktop applications.

The system's release was announced at a PLDI tutorial on June 16, 2002, titled "On the Run - Building Dynamic Program Modifiers for Optimization, Introspection and Security." Here is the tutorial abstract:

In the new world of software, which heavily utilizes dynamic class loading, DLLs and interconnected components, the power and reach of static analysis is diminishing. An exciting new paradigm of dynamic program optimization, improving the performance of a program while it is being executed, is emerging. In this tutorial, we will describe intricacies of building a dynamic optimizer, explore novel application areas such as program introspection and security, and provide details of building your own dynamic code modifier using DynamoRIO. DynamoRIO, a joint development between HP Labs and MIT, is a powerful dynamic code modification infrastructure capable of running existing binaries such as Microsoft Office Suite. It runs on both Windows and Linux environments. We are offering a free release of DynamoRIO for non-commercial use. A copy of the DynamoRIO release, which includes the binary and a powerful API, will be provided to the attendees.

Tool Added: Adobe Flash disassembler

Sat, 09 Jan 2010 19:23:46 GMT

Listed in categories: Flash Disassemblers, IDA Extensions

Most recent version:

Most recent release date:
November 19, 2009

Description:
Shockwave Flash is a very common and widely used file format that, unfortunatelly, has not been able to make its way into IDA's recognized file formats. The increasing numbers of grayware and malware SWF files require security researchers to disassemble and analyse such files and IDA is again an ideal tool to use.

The 2 plugins present in this archive will enable IDA to parse SWF files, load all SWF tags as segments for fast search and retrieval, parse all tags that can potentially contain ActionScript2 code, discover all such code(a dedicated processor module has been written for it) and even name the event functions acording to event handled in it (eg. OnInitialize).

There are two different modules: a file loader module and a processor module. Together, they make it possible to analyze Flash SWF files with IDA, as simple as that. It was very easy to install and run the plugin: just copy 2 files to the IDA subdirectories and it is ready.

Flash files can be loaded very easily into IDA, and you'll see a bytecode, as in the screenshot here below.

Tool Updated: Dedexer

Mon, 28 Dec 2009 14:53:10 GMT

Listed in categories: Android Tools, Mobile Platform Disassemblers

Most recent version:
1.9

Most recent release date:
December 12, 2009

Description:
"Dedexer is a disassembler tool for DEX files. DEX is a format introduced by the creators of the Android platform. The format and the associated opcode set is in distant relationship with the Java class file format and Java bytecodes. Dedexer is able to read the DEX format and turn into an "assembly-like format". This format was largely influenced by the Jasmin syntax but contains Dalvik opcodes. For this reason, Jasmin is not able to compile the generated files."

Tool Updated: P32DASM

Thu, 24 Dec 2009 20:24:07 GMT

Listed in categories: Disassemblers, Visual Basic Decompilers

Most recent version:
2.6

Most recent release date:
Dec 24, 2009

Description:
P32Dasm is a Visual Basic 5.0/6.0 PCode + Native code Decompiler. It can generate String, Numbers, Objects, Import and Export function listing. There is also Jump calculator. For VB Native code executables are generated only MSVBVM, External calls and string references. Usefull for setting BPX, you don't need search in debugger where start some Command Button event. You can generate .map files, which you can import to DataRescue IDA (LoadMap plugin) or to Olly Debugger (MapConv plugin).

Tool Updated: Dotnet IL Editor (DILE)

Sun, 09 Aug 2009 13:13:28 GMT

Listed in categories: .NET Debuggers, .NET Disassemblers, .NET Executable Editors

Most recent version:
0.2.6

Most recent release date:
September 30, 2007

Description:
Dotnet IL Editor (DILE) is an editor program which helps modifying .NET assemblies. It is intended to be able to disassemble .NET assemblies, modify the IL code, recompile it and run inside a debugger.

Tool Updated: IDA Pro

Thu, 06 Aug 2009 16:22:01 GMT

Listed in categories: .NET Disassemblers, Disassemblers, IPhone Tools, Linux Debuggers, Linux Disassemblers, Mobile Platform Debuggers, Mobile Platform Disassemblers, Ring 3 Debuggers, Symbian Tools

Most recent version:
5.5

Most recent release date:
June 15, 2009

Description:
The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows or on Linux. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.

There is also a free (crippled) version available (IDA Pro Free). See its own entry in the library for more info.

As of January 7, 2007, the official IDA Pro website moved from the old URL (http://www.datarescue.com/idabase) to the one listed above.

Tool Updated: Reflector for .NET

Sun, 19 Jul 2009 04:59:56 GMT

Listed in categories: .NET Decompilers, .NET Disassemblers, Decompilers

Most recent version:
5.1.4.0

Most recent release date:
July 18, 2009

Description:
From website:

"Reflector is a very powerful class browser, explorer, analyzer and documentation viewer for .NET. Reflector allows to easily view, navigate, search, decompile and analyze .NET assemblies in C#, Visual Basic and IL."

This is one of the most powerful .NET decompilers that you can't buy - just download :)
Many of the popular commercial tools achieving the same goal "suddenly" got a boost when this masterpiece of work saw a daylights (and besides that those are commercial, still have hard time with obfuscators).

Just give it a try, it will last literally five minutes - load some well known assembly of yours, choose target .NET language (!) and let'em work. Then compare it with the original.

You'll surely not forget this one.

Tool Updated: PEBrowse Professional

Sat, 18 Jul 2009 23:05:32 GMT

Listed in categories: .NET Disassemblers, .NET Tools, COM Tools, Delphi Tools, Disassemblers, Exe Analyzers, Memory Dumpers

Most recent version:
10.0.1

Most recent release date:
July 12, 2009

Description:
PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others. (We have received reports that the software also works on other OSes, including Wine (!) and Windows CE.)

With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse. The information is organized in a convenient treeview index with the major divisions of the PE file displayed as nodes. In most cases selecting nodes will enable context-sensitive multiple view menu options, including binary dump, section detail, disassembly and structure options as well as displaying sub-items, such as optional header directory entries or exported functions, that can be found as part of a PE file unit. Several table displays, hex/ASCII equivalents, window messages and error codes, as well as a calculator and scratchpads are accessible from the main menu.

While the binary dump display offers various display options, e.g., BYTE, WORD, or DWORD alignment, the greatest value of PEBrowse comes when one disassembles an entry-point. An entry-point in PEBrowse is defined as:

* Module entry-point
* Exports (if any)
* Debug-symbols (if a valid PDB, i.e., program database file, is present)
* Imported API references
* Relocation addresses
* Internal functions/subroutines
* Any valid address inside of the module

Selecting and disassembling any number of these entry-points produces a versatile display rich in detail including upper/lowercase display, C/Pascal/Assembler suffix/prefixing, object code, color-coded statements, register usage highlighting, and jump/call target preview popups. Additional information, such as variable and function names, will also be present if one has access to a valid PDB file. Disassembly comes in two flavors: linear sweep (sequential disassembly from a starting address) and recursive traversal, aka, analysis mode (disassembly of all statements reachable by non-call statements - extended analysis disassembles all internal call statements as well). The latter mode also presents local variables with cross-referencing, highlighting, and renaming options. If one adds/changes variable name or adds comments to specific lines, these can be displayed in a session file which will record and save all currently opened displays.

PEBrowse Professional will decompile type library information either embedded inside of the binary as the resource "TYPELIB" or inside of individual type libraries, i.e., .TLB or .OLB files.

PEBrowse Professional also displays all metadata for .NET assemblies and displays IL (Intermediate Language) for .NET methods. It seamlessly handles mixed assemblies, i.e., those that contain both native and managed code.

Finally, PEBrowse can be employed as a file browse utility for any type of file with the restriction that the file must be small enough that it can be memory-mapped.

Tool Updated: Sourcer

Wed, 17 Jun 2009 11:46:05 GMT

Listed in categories: Disassemblers

Most recent version:
8.0

Most recent release date:
2001

Description:
Sourcer was a popular "commenting disassembler" back in the DOS day, trying to help your disassembling by adding informational comments to the disassembly.

Tool Updated: W32DASM

Wed, 17 Jun 2009 11:26:02 GMT

Listed in categories: Disassemblers, Ring 3 Debuggers

Most recent version:
8.94

Most recent release date:
March 11, 2003

Description:
Before IDA Pro, W32DASM was the king of Windows 32 bit executable disassemblers.

It also has a ring 3 debugger built-in.

Tool Added: Nemo 440

Fri, 05 Jun 2009 21:17:54 GMT

Listed in categories: Flash Disassemblers

Most recent version:
1.0.5

Most recent release date:
January 21, 2009

Description:
Advanced ActionScript 3/ABC2/Flex 2/Flex 3/Flex 4/AIR disassembler.

To continue learning Flex/AIR, to better understand how Flash engine and undocumented Flex classes works, and for fun, Nemo 440 tool has been created. It's free ABC code diassembler implemented as AIR-based application. This is my first experience with AIR platform. Nemo 440 can read SWF files compiled with Flex 2/Flex 3/Flex 4 and translates ActionScript 3 byte code to more understandable text dump. Actually similar tool was created year or so before by other people, I only added minor changes and started connecting these ideas with user interface.

There are good programs like Flare and Flasm tools from Igor Kogan. Unfortunately with ActionScript 3/Flash 9/Flex 2 it doesn't work anymore.

With Flex 3 Adobe provides Java "swfutils.jar" tool to disassemble SWF content. Gordon Smith published good article describing this functionality: Disassembling a SWF with swfdump . Interesting fact that for early Flex 2 builds (around alpha version), we used similar tool located in "swfkit.jar", but it had problem with parsing runtime and for 30% of classes in other libraries. With Flex 2 Beta version it started to work worse. Sounds like now Adobe again reborned this tool. Hope it will work well in future.

Nemo 440 is free tool, USE IT AT YOUR OWN RISK, NO WARRANTIES ARE EXTENDED. It is not going to be commercial product in future. Ideally it would be nice to get something like Lutz Roeder's Reflector for .NET, disassembler, decompiler and more in one box, but for Flex. At this moment I am completely busy and probably won't do any good progress in these fields...

Nemo 440 can load files from URL via HTTP or from disk ("Open URL..."/"Open File..." commands accordingly). Supported binary formats are:

* Uncompressed SWF (*.swf),
* Compressed SWF (*.swf),
* ActionScript library (*.swc),
* Raw ABC2 byte code (*.abc).