The simple way is to just read one byte, decode it and then determine if it’s a complete instruction. If not read another byte, decode it if necessary and then determine if a complete instruction has been read. If not continue reading/decoding bytes until the complete instruction is read. This means that if the instruction … Read more
Convert the assembly to IL, do a textual search and replace, recompile the IL to an assembly again. Use the standard tools from the .NET SDK.
In the java language, inner classes can access private members of their enclosing class. However, in Java bytecode, the concept of inner classes does not exist, and the private members are not accessible. To work around this, the compiler creates synthetic accessor methods in the outer class. I believe that is what you are seeing … Read more
Looks like the dissembler used short-hand for SAR EAX,1 which has an opcode of 0xD1F8. when the immediate is not 1, aka SAR EAX,xx, the opcode is 0xC1F8 xx, see the Intel Instruction reference, Vol. 2B, 4-353.
The purpose of that area is revealed by the following code int main(int argc, char** argv) { if (rand() == 42) return 1; printf(“Helo World!\n”); return 0; } At the start it does movl $0, -4(%rbp) then the early return looks as follows callq rand cmpl $42, %eax jne .LBB0_2 movl $1, -4(%rbp) jmp .LBB0_3 … Read more
.pyc files contain some metadata and a marshaled code object; to load the code object and disassemble that use: import dis, marshal, sys header_sizes = [ # (size, first version this applies to) # pyc files were introduced in 0.9.2 way, way back in June 1991. (8, (0, 9, 2)), # 2 bytes magic number, … Read more
AFAIK, the native Darwin binary tools are part of the cctools package. They don’t have the same command line syntax or output as the GNU binutils. Later binutils (i.e., 2.22) supports the Mach-O format however. You can get these prebuilt, with the ‘g‘ prefix to the tool names, as mentioned here. Alternatively, you can compile … Read more
mcsema is a production-quality binary lifter. It takes x86 and x86-64 and statically “lifts” it to LLVM IR. It’s actively maintained, BSD licensed, and has extensive tests and documentation. https://github.com/trailofbits/mcsema
I don’t think there is any reliable way to do this. Machine code formats are very complicated, more complicated than assembly files. It isn’t really possible to take a compiled binary (say, in ELF format) and produce a source assembly program which will compile to the same (or similar-enough) binary. To gain an understanding of … Read more
@AlexisWilke’s response is right: this is messy. He provides the right insights and references to do the work, too. I have done this work in C. The code follows; this is used in production contexts. Caveats: It does a good part of the traditional x86 instruction set, but not all, in particular none of the … Read more