x86 Disassembly/Analysis Tools

DebuggersEdit

Debuggers are programs that allow the user to execute a compiled program one step at a time. You can see what instructions are executed in which order, and which sections of the program are treated as code and which are treated as data. Debuggers allow you to analyze the program while it is running, to help you get a better picture of what it is doing.

Advanced debuggers often contain at least a rudimentary disassembler, often times hex editing and reassembly features. Debuggers often allow the user to set breakpoints on instructions, function calls, and even memory locations.

A breakpoint is an instruction to the debugger that allows program execution to be halted when a certain condition is met. For instance, when a program accesses a certain variable, or calls a certain API function, the debugger can pause program execution.

Windows DebuggersEdit

SoftICE 
A de facto standard for Windows debugging. SoftICE can be used for local kernel debugging, which is a feature that is very rare, and very valuable. SoftICE was taken off the market in April 2006.
WinDbg 
WinDbg is a free piece of software from Microsoft that can be used for local user-mode debugging, or even remote kernel-mode debugging. WinDbg is not the same as the better-known Visual Studio Debugger, but comes with a nifty GUI nonetheless. Available in 32 and 64-bit versions.
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
IDA Pro 
The multi-processor, multi-OS, interactive disassembler by DataRescue.
http://www.hex-rays.com/idapro/
OllyDbg 
OllyDbg is a free and powerful Windows debugger with a built-in disassembly and assembly engine. Very useful for patching, disassembling, and debugging.
http://www.ollydbg.de/
Immunity Debugger 
Immunity Debugger is a branch of OllyDbg v1.10, with built-in support for Python scripting and much more.
http://immunityinc.com/products-immdbg.shtml

Linux DebuggersEdit

gdb 
The GNU debugger, comes with any normal Linux install. It is quite powerful and even somewhat programmable, though the raw user interface is harsh.
emacs 
The GNU editor, can be used as a front-end to gdb. This provides a powerful hex editor and allows full scripting in a LISP-like language.
ddd 
The Data Display Debugger. It's another front-end to gdb. This provides graphical representations of data structures. For example, a linked list will look just like a textbook illustration.
strace, ltrace, and xtrace 
Lets you run a program while watching the actions it performs. With strace, you get a log of all the system calls being made. With ltrace, you get a log of all the library calls being made. With xtrace, you get a log of some of the funtion calls being made.
valgrind 
Executes a program under emulation, performing analysis according to one of the many plug-in modules as desired. You can write your own plug-in module as desired. Newer versions of valgrind also support OS X.
NLKD 
A kernel debugger.
http://forge.novell.com/modules/xfmod/project/?nlkd
edb 
A fully featured plugin-based debugger inspired by the famous OllyDbg. Project page
KDbg 
A gdb front-end for KDE. http://kdbg.org
RR0D 
A Ring-0 Debugger for Linux. RR0D Project Page

Debuggers for Other SystemsEdit

dbx 
The standard Unix debugger on systems derived from AT&T Unix. It is often part of an optional development toolkit package which comes at an extra price. It uses an interactive command line interface.
ladebug 
An enhanced debugger on Tru64 Unix systems from HP (originally Digital Equipment Corporation) that handles advanced functionality like threads better than dbx.
DTrace 
An advanced tool on Solaris that provides functions like profiling and many others on the entire system, including the kernel.
mdb 
The Modular Debugger (MDB) is a new general purpose debugging tool for the Solaris Operating Environment. Its primary feature is its extensibility. The Solaris Modular Debugger Guide describes how to use MDB to debug complex software systems, with a particular emphasis on the facilities available for debugging the Solaris kernel and associated device drivers and modules. It also includes a complete reference for and discussion of the MDB language syntax, debugger features, and MDB Module Programming API.

Debugger TechniquesEdit

Setting BreakpointsEdit

As previously mentioned in the section on disassemblers, a 6-line C program doing something as simple as outputting "Hello, World!" turns into massive amounts of assembly code. Most people don't want to sift through the entire mess to find out the information they want. It can be time consuming just to find the information one desires by just looking through the code. As an alternative, one can choose to set breakpoints to halt the program once it has reached a given point within the program's code.

For instance, let's say that in your program you consistantly experience crashes after one particular event: immediately after closing a message box. You set breakpoints on all calls to MessageBoxA. You run your program with the breakpoints set, and it stops, ready to call MessageBoxA. Executing each line one-by-one thereafter (referred to as stepping) through the code, and watching the program stack, you see that a buffer overflow occurs soon after the call.

Hex EditorsEdit

Hex editors are able to directly view and edit the binary of a source file, and are very useful for investigating the structure of proprietary closed-format data files. There are many hex editors in existence. This section will attempt to list some of the best, some of the most popular, or some of the most powerful.

wxHexEditor (For Windows and Linux, Free & Open Source)
A fast hex editor specially for HUGE files and disk devices, allows up to hexabyte, allow size changes (inject and deletes) without creating temp file, could view files with multiple panes, has built-in disassembler, supports tags for (reverse) engineering big binaries or file systems, could view files thrug XOR encryption.
http://wxhexeditor.sourceforge.net/
HxD (Freeware)
For Windows. A fast and powerful free hex, disk and RAM editor
http://mh-nexus.de/hxd/
Freeware Hex Editor XVI32 
For Windows. A freeware hex editor.
http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
HHD Software Hex Editor Neo 
For Windows. A fast file, disk, and memory editor with built-in disassembler and file structure viewer.
http://www.hhdsoftware.com/Family/hex-editor.html
Catch22 HexEdit 
For Windows. his is a powerful hex editor with a slew of features. Has an excellent data structure viewer.
http://www.catch22.net/software/hexedit.asp
BreakPoint Hex Workshop 
For Windows. An excellent and powerful hex-editor, its usefulness is restricted by the fact that it is not free like some of the other options.
http://www.bpsoft.com/
Tiny Hexer 
Free and does statistics. For Windows.
http://www.mirkes.de/files/
frhed - free hex editor 
For Windows. Free and opensource.
http://www.kibria.de/frhed.html
Cygnus Hex Editor
For Windows. A very fast and easy-to-use hex editor, available in a 'Free Edition'.
http://www.softcircuits.com/cygnus/fe/
Hexprobe Hex Editor 
For Windows. A professional hex editor designed to include all the power to deal with hex data, particularly helpful in the areas of hex-byte editing and byte-pattern analysis.
http://www.hexprobe.com/hexprobe/index.htm
UltraEdit32 
For Windows. A hex editor/text editor, won "Application of the Year" at 2005 Shareware Industry Awards Conference.
http://www.ultraedit.com/
ICY Hexplorer 
For Windows. A lightweight free and open source hex file editor with some nifty features, such as pixel view, structures, and disassembling.
http://hexplorer.sourceforge.net/
WinHex 
For Windows. A powerful hex file and disk editor with advanced abilities for computer forensics and data recovery (used by governments and military).
http://www.x-ways.net/index-m.html
010 Editor 
For Windows. A very powerful and fast hex editor with extensive support for data structures and scripting. Can be used to edit drives and processes.
http://www.sweetscape.com/010editor/
A view of a small binary file in a 1Fh hex editor.
1Fh 
For Windows. A free binary/hex editor which is very fast, even while working with large files. It's the only Windows hex editor that allows you to view files in byte code (all 256-characters).
http://www.4neurons.com/1Fh/
HexEdit 
For Windows (Open source) and shareware versions. Powerful and easy to use binary file and disk editor.
http://www.hexedit.com/
HexToolkit 
For Windows. A free hex viewer specifically designed for reverse engineering file formats. Allows data to be viewed in various formats and includes an expression evaluator as well as a binary file comparison tool.
http://www.binaryearth.net/HexToolkit
FlexHex 
For Windows. It Provides full support for NTFS files which are based on a more complex model than FAT32 files. Specifically, FlexHex supports Sparse files and Alternate data streams of files on any NTFS volume. Can be used to edit OLE compound files, flash cards, and other types of physical drives.
http://www.heaventools.com/flexhex-hex-editor.htm
HexEdit 
For MacOS. A simple but reliable hex editor wher you to change highlight colours. There is also a port for Apple Classic users.
http://hexedit.sourceforge.net/
Hex Fiend 
For MacOS. A very simple hex editor, but incredibly powerful nonetheless. It's only 346 KB to download and takes files as big as 116 GB.
http://ridiculousfish.com/hexfiend/


Linux Hex Editors onlyEdit

bvi
A typical three-pane hex editor, with a vi-like interface.
emacs 
Along with everything else, emacs also includes a hex editor.
joe 
Joe's own editor now also supports hex editing.
bless 
A very capable gtk based hex editor.
xxd and any text editor 
Produce a hex dump with xxd, freely edit it in your favorite text editor, and then convert it back to a binary file with your changes included.
GHex 
Hex editor for GNOME.
http://directory.fsf.org/All_Packages_in_Directory/ghex.html
Okteta 
The well-integrated hexeditor from KDE since 4.1. Offers the traditional two-columns layout, one with numeric values (binary, octal, decicmal, hexdecimal) and one with characters (lots of charsets supported). Editing can be done in both columns, with unlimited undo/redo. Small set of tools (searching/replacing, strings, binary filter, and more).
http://utils.kde.org/projects/okteta
BEYE 
A viewer of binary files with built-in editor in binary, hexadecimal and disassembler modes. It uses native Intel syntax for disassembly. Highlight AVR/Java/Athlon64/Pentium 4/K7-Athlon disassembler, Russian codepages converter, full preview of formats - MZ, NE, PE, NLM, coff32, elf partial - a.out, LE, LX, PharLap; code navigator and more over. (
http://beye.sourceforge.net/en/beye.html
BIEW 
A viewer of binary files with built-in editor in binary, hexadecimal and disassembler modes. It uses native Intel syntax for disassembly. Highlight AVR/Java/Athlon64/Pentium 4/K7-Athlon disassembler, Russian codepages converter, full preview of formats - MZ, NE, PE, NLM, coff32, elf partial - a.out, LE, LX, PharLap; code navigator and more over. (PROJECT RENAMED, see BEYE)
http://biew.sourceforge.net/en/biew.html
hview 
A curses based hex editor designed to work with large (600+MB) files with as quickly, and with little overhead, as possible.
http://tdistortion.esmartdesign.com/Zips/hview.tgz
HT Editor 
A file editor/viewer/analyzer for executables. Its goal is to combine the low-level functionality of a debugger and the usability of IDEs.
http://hte.sourceforge.net/
HexCurse 
An ncurses-based hex editor written in C that currently supports hex and decimal address output, jumping to specified file locations, searching, ASCII and EBCDIC output, bolded modifications, an undo command, quick keyboard shortcuts, etc.
http://www.jewfish.net/description.php?title=HexCurse
hexedit 
View and edit files in hexadecimal or in ASCII.
http://rigaux.org/hexedit.html
Data Workshop 
An editor to view and modify binary data; provides different views which can be used to edit, analyze and export the binary data.
http://www.dataworkshop.de/
VCHE
A hex editor which lets you see all 256 characters as found in video ROM, even control and extended ASCII, it uses the /dev/vcsa* devices to do it. It also could edit non-regular files, like hard disks, floppies, CDROMs, ZIPs, RAM, and almost any device. It comes with a ncurses and a raw version for people who work under X or remotely.
http://www.grigna.com/diego/linux/vche/
DHEX
DHEX is just another Hexeditor with a Diff-mode for ncurses. It makes heavy use of colors and is themeable.
http://www.dettus.net/dhex/


Other Tools for WindowsEdit

Resource MonitorsEdit

SysInternals Freeware 
This page has a large number of excellent utilities, many of which are very useful to security experts, network administrators, and (most importantly to us) reversers. Specifically, check out Process Monitor, FileMon, RegMon, TCPView, and Process Explorer.
http://technet.microsoft.com/sysinternals/default.aspx

API MonitorsEdit

SpyStudio Freeware 
The Spy Studio software is a tool to hook into windows processes, log windows API call to DLLs, insert breakpoints and change parameters.
http://www.nektra.com/products/spystudio/
rohitab.com API Monitor 
API Monitor is a free software that lets you monitor and control API calls made by applications and services. Features include detailed parameter information, structures, unions, enumerated/flag data types, call stack, call tree, breakpoints, custom DLL's, memory editor, call filtering, COM monitoring, 64-bit. Includes definitions for over 13,000 API's and 1,300+ COM interfaces.
http://www.rohitab.com/apimonitor

PE File Header dumpersEdit

Dumpbin 
Dumpbin is a program that previously used to be shipped with MS Visual Studio, but recently the functionality of Dumpbin has been incorporated into the Microsoft Linker, link.exe. to access dumpbin, pass /dump as the first parameter to link.exe:
link.exe /dump [options]
It is frequently useful to simply create a batch file that handles this conversion:
::dumpbin.bat
link.exe /dump %*

All examples in this wikibook that use dumpbin will call it in this manner.

Here is a list of useful features of dumpbin [1]:
dumpbin /EXPORTS         displays a list of functions exported from a library
dumpbin /IMPORTS         displays a list of functions imported from other libraries
dumpbin /HEADERS         displays PE header information for the executable
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore/html/_core_dumpbin_reference.asp
Depends 
Dependency Walker is a GUI tool which will allow you to see exports and imports of binaries. It ships with many Microsoft tools including MS Visual Studio.

GNU ToolsEdit

The GNU packages have been ported to many platforms including Windows.

GNU BinUtils 
The GNU BinUtils package contains several small utilities that are very useful in dealing with binary files. The most important programs in the list are the GNU objdump, readelf, GAS assembler, and the GNU linker, although the reverser might find more use in addr2line, c++filt, nm, and readelf.
http://www.gnu.org/software/binutils/
objdump 
Dumps out information about an executable including symbols and assembly. It comes standard. It can be made to support non-native binary formats.
objdump -p               displays a list of functions imported from other libraries, exported to and miscellaneous file header information

It's useful to check dll dependencies from command line

readelf 
Like objdump but more specialized for ELF executables.
size 
Lists the sizes of the segments.
nm 
Lists the symbols in an ELF file.
strings 
Prints the strings from a file.
file 
Tells you what type of file it is.
fold 
Folds the results of strings into something pageable.
kill 
Can be used to halt a program with the sig_stop signal.
strace 
Trace system calls and signals.

Other Tools for LinuxEdit

oprofile 
Can be used the find out what functions and data segments are used
subterfugue 
A tool for playing odd tricks on an executable as it runs. The tool is scriptable in python. The user can write scripts to take action on events that occur, such as changing the arguments to system calls.
http://subterfugue.org/
lizard 
Lets you run a program backwards.
http://lizard.sourceforge.net/
dprobes 
Lets you work with both kernel and user code.
biew 
Both a hex editor and a disassembler.
ltrace 
Displays runtime library call information for dynamically linked executables.
asmDIFF 
Searches for functions, instructions and memory pointers in different versions of same binary by using code metrics. Supports x86, x86_64 code in PE and ELF files.
http://duschkumpane.org/index.php/asmdiff
Last modified on 7 January 2014, at 15:30