- The Online Disassembler is a free web-based, reverse engineering platform that supports over 60 architectures and object file formats from all the major operating systems, including Windows, Mac OS X, Linux, and mobile platforms.
- IDA is a disassembler and debugger that’s suitable for performing complex research of executables. It’s a cross-platform tool that runs on macOS, Windows, and Linux. IDA can be used for disassembling software designed for macOS, Windows, and Linux platforms. The program has a free evaluation version with limited functionality.
- The IDA Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X. IDA has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.
I am using the otool, nm and Fraise text editor to disassemble the Mach-o binaries. My workflow at this point is pretty straightforward: 1. List the existed symbols. Get the disasm code. Copy and paste this output to a text file. Hopper Disassembler, the reverse engineering tool that lets you disassemble, decompile and debug your applications. Hopper v4 for Mac requires macOS 10.9 or higher. Hopper v3 for Linux requires Ubuntu 14.04, Arch Linux, Fedora 20 or higher, and a 64 bits processor.
Original author(s) | Ilfak Guilfanov |
---|---|
Stable release | |
Written in | C++[2] |
Operating system | Microsoft Windows, Mac OS X, and Linux |
Available in | English, Russian |
Type | Disassembler |
License | Proprietary |
Website | www.hex-rays.com/products/ida/index.shtml |
Disassembler Software
The Interactive Disassembler (IDA) is a disassembler for computersoftware which generates assembly languagesource code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS XMach-O, and LinuxELF executables. A decompiler plug-in for programs compiled with a C/C++compiler is available at extra cost. The latest full version of IDA Pro is commercial, while an earlier and less capable version is available for download free of charge (version 7.0 as of February 2018).[3]
IDA performs automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.
Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008, Hex-Rays assumed the development and support of DataRescue's IDA Pro.[4]
Scripting[edit]
'IDC scripts' make it possible to extend the operation of the disassemble. Some helpful scripts are provided, which can serve as the basis for user written scripts. Most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the function names of the original source code.
Users have created plugins that allow other common scripting languages to be used instead of, or in addition to, IDC. IdaRUB supports Ruby and IDAPython adds support for Python. As of version 5.4, IDAPython (dependent on Python 2.5) comes preinstalled with IDA Pro.
Supported systems/processors/compilers[edit]
- System hosts
- Windows x86 and ARM
- Linux x86
- Mac OS X x86
- Recognized executable file formats
- COFF and derivatives, including Win32/64/generic PE
- ELF and derivatives (generic)
- Mach-O (Mach)
- NLM (NetWare)
- LC/LE/LX (OS/2 3.x and various DOS extenders)
- NE (OS/2 2.x, Win16, and various DOS extenders)
- MZ (MS-DOS)
- OMF and derivatives (generic)
- AIM (generic)
- raw binary, such as a ROM image or a COM file
- Instruction sets
- Intel 80x86 family
- Motorola 68k and H8
- Analog Devices ADSP218x
- Angstrem KR1878
- Atmel AVR series
- DEC series PDP11
- Fujitsu F2MC16L/F2MC16LX
- Fujitsu FR 32-bit Family
- Hitachi SH3/SH3B/SH4/SH4B
- Hitachi H8: h8300/h8300a/h8s300/h8500
- Intel 196 series: 80196/80196NP
- Intel 51 series: 8051/80251b/80251s/80930b/80930s
- Intel i960 series
- Intel Itanium (ia64) series
- Java virtual machine
- MIPS: mipsb/mipsl/mipsr/mipsrl/r5900b/r5900l
- Microchip PIC: PIC12Cxx/PIC16Cxx/PIC18Cxx
- Mitsubishi 7700 Family: m7700/m7750
- Mitsubishi m32/m32rx
- Mitsubishi m740
- Mitsubishi m7900
- Motorola DSP 5600x Family: dsp561xx/dsp5663xx/dsp566xx/dsp56k
- Motorola ColdFire
- Motorola HCS12
- NEC 78K0/78K0S
- PA-RISC
- PowerPC
- Xenon PowerPC Family
- SGS-Thomson ST20/ST20c4/ST7
- SPARC Family
- Samsung SAM8
- Siemens C166 series
- TMS320Cxxx series
- Compiler/libraries (for automatic library function recognition)[5]
- Borland C++ 5.x for DOS/Windows
- Borland C++ 3.1
- Borland C Builder v4 for DOS/Windows
- GNU C++ for Cygwin
- Microsoft QuickC
- Microsoft Visual C++
- Watcom C++ (16/32 bit) for DOS/OS2
- ARM C v1.2
- GNU C++ for Unix/common
Debugging[edit]
IDA Pro supports a number of debuggers,[6] including:
- Remote Windows, Linux, and Mac applications (provided by Hex-Rays) allow running an executable in its native environment (presumably using a virtual machine for malware)
- GNU Debugger (gdb) is supported on Linux and OS X, as well as the native Windows debugger
- A Bochs plugin is provided for debugging simple applications (i.e., damaged UPX or mpress compacted executables)
- An Intel PIN-based debugger
- A trace replayer
See also[edit]
References[edit]
- ^IDA Pro 7.5 SP2 released (July 28, 2020)
- ^Hex-rays Home
- ^IDA Pro 7.0 Freeware version download
- ^'About Us'. Hex-Rays. 27 February 2012. Retrieved 2 September 2013.
- ^'FLIRT Compiler Support'. Hex-Rays.
- ^Eagle, Chris (2008). The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press. ISBN978-1-59327-178-7.
Disassembler Free Download
Further reading[edit]
- Eilam, Eldad (2005). Reversing: Secrets of Reverse Engineering. Wiley Publishing. p. 595. ISBN0-7645-7481-7.
External links[edit]
Ida Interactive Disassembler
- 'IDA Pro' (in Russian).
- 'IDA plug-ins and scripts'. Open Reverse Code Engineering (OpenRCE).
Retrieved from 'https://en.wikipedia.org/w/index.php?title=Interactive_Disassembler&oldid=980774437'