Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Get back the assembly level code from exe files?

Tags:

assembly

I was doing linux assembly programming and for the past few days I have switched to learn windows assembly programming. I am using ml as my assembler and golink as my linker. I have my assembly code and have obtained my exe from it. Now I need to get back its hex like \xff\xab\x55 and so on. In linux I used objdump -d elf_executable or xxd -i file. What is its windows equivalent ?
Edit I need to mention that with objdump on windows I am getting the following error

C:\Arena>objdump -d a.exe                                                                                                                                                 
objdump: a.exe: File format not recognized

After compiling it with

C:\Arena>ml a.asm
Microsoft (R) Macro Assembler Version 10.00.30319.01                                                                                                                      
Copyright (C) Microsoft Corporation.  All rights reserved.                                                                                                                

 Assembling: a.asm  
C:\Arena>golink a.obj kernel32.dll user32.dll                                                                                                                             

GoLink.Exe Version 0.26.14 - Copyright Jeremy Gordon 2002/9 - [email protected]                                                                                              
Output file: a.exe                                                                                                                                                        
Format: win32 size: 1,536 bytes
like image 755
vikkyhacks Avatar asked Dec 09 '22 13:12

vikkyhacks


2 Answers

If you have Visual Studio installed, you can use DUMPBIN:

dumpbin /DISASM /out:log.txt file.exe
like image 178
Igor Skochinsky Avatar answered Jan 18 '23 16:01

Igor Skochinsky


I have used the program dumppe.exe before for disassembly.

By typing;

where dumppe
for me dumppe.exe turns out to be in the same directory as ml.exe; masm32\bin\dumppe.exe

for a rough disassembly you can enter;

dumppe -quiet -disassem [file-name-here]

alternatively you could enter;

dumppe -quiet -disassem:![lable-here] [file-name-here]

or for more info just type "dumppe" at the cmd prompt.

I also have a windows version of grep installed on my windows and when i use the cmd

dumppe -disassem -quiet win.exe | grep -A10 start:

I get;

00401000                    start:
00401000 6A00                   push    0
00401002 680F304000             push    offset off_0040300F     ; 'program statment!!!',000h
00401007 6800304000             push    offset off_00403000     ; 'hello world!!!',000h
0040100C 6A00                   push    0
0040100E E80D000000             call    jmp_MessageBoxA
00401013 6A00                   push    0
00401015 E800000000             call    jmp_ExitProcess

0040101A                    jmp_ExitProcess:            ; Xref 00401015
0040101A FF2500204000           jmp     dword ptr [ExitProcess]

a comparasin to when i use objdump

objdump -M intel -D win.exe | grep -A10 text.:
which is pretty much the same as
objdump -M intel -d win.exe

I get;

00401000 <.text>:
  401000:       6a 00                   push   0x0
  401002:       68 0f 30 40 00          push   0x40300f
  401007:       68 00 30 40 00          push   0x403000
  40100c:       6a 00                   push   0x0
  40100e:       e8 0d 00 00 00          call   0x401020
  401013:       6a 00                   push   0x0
  401015:       e8 00 00 00 00          call   0x40101a
  40101a:       ff 25 00 20 40 00       jmp    DWORD PTR ds:0x402000
  401020:       ff 25 08 20 40 00       jmp    DWORD PTR ds:0x402008
like image 42
James Avatar answered Jan 18 '23 16:01

James