CODEWITHSUNDEEP
assembly
vikkyhacks
vikkyhacks

Reputation: 3230

Get back the assembly level code from exe files?

I was doing linux assembly programming and for the past few days I have switched to learn windows assembly programming. I am using ml as my assembler and golink as my linker. I have my assembly code and have obtained my exe from it. Now I need to get back its hex like \xff\xab\x55 and so on. In linux I used objdump -d elf_executable or xxd -i file. What is its windows equivalent ?
Edit I need to mention that with objdump on windows I am getting the following error

C:\Arena>objdump -d a.exe                                                                                                                                                 
objdump: a.exe: File format not recognized

After compiling it with 

C:\Arena>ml a.asm
Microsoft (R) Macro Assembler Version 10.00.30319.01                                                                                                                      
Copyright (C) Microsoft Corporation.  All rights reserved.                                                                                                                

 Assembling: a.asm  
C:\Arena>golink a.obj kernel32.dll user32.dll                                                                                                                             

GoLink.Exe Version 0.26.14 - Copyright Jeremy Gordon 2002/9 - [email protected]                                                                                              
Output file: a.exe                                                                                                                                                        
Format: win32 size: 1,536 bytes

Upvotes: 5

Views: 15002

Answers (4)

Igor Skochinsky
Igor Skochinsky

Reputation: 25318

If you have Visual Studio installed, you can use DUMPBIN:

dumpbin /DISASM /out:log.txt file.exe

Upvotes: 9

Dominik Antal
Dominik Antal

Reputation: 3391

If you don't mind that these tools only operate with GUI (afaik), check out IDA Pro (static), OllyDbg(dynamic), they display the instructions, and the opcodes.

Upvotes: 0

James
James

Reputation: 1019

I have used the program dumppe.exe before for disassembly.

By typing; 

where dumppe
for me dumppe.exe turns out to be in the same directory as ml.exe; masm32\bin\dumppe.exe

for a rough disassembly you can enter; 

dumppe -quiet -disassem [file-name-here]

alternatively you could enter; 

dumppe -quiet -disassem:![lable-here] [file-name-here]

or for more info just type "dumppe" at the cmd prompt.

I also have a windows version of grep installed on my windows and when i use the cmd 

dumppe -disassem -quiet win.exe | grep -A10 start:

I get;

00401000                    start:
00401000 6A00                   push    0
00401002 680F304000             push    offset off_0040300F     ; 'program statment!!!',000h
00401007 6800304000             push    offset off_00403000     ; 'hello world!!!',000h
0040100C 6A00                   push    0
0040100E E80D000000             call    jmp_MessageBoxA
00401013 6A00                   push    0
00401015 E800000000             call    jmp_ExitProcess

0040101A                    jmp_ExitProcess:            ; Xref 00401015
0040101A FF2500204000           jmp     dword ptr [ExitProcess]

a comparasin to when i use objdump 

objdump -M intel -D win.exe | grep -A10 text.:
which is pretty much the same as 

objdump -M intel -d win.exe

I get;

00401000 <.text>:
  401000:       6a 00                   push   0x0
  401002:       68 0f 30 40 00          push   0x40300f
  401007:       68 00 30 40 00          push   0x403000
  40100c:       6a 00                   push   0x0
  40100e:       e8 0d 00 00 00          call   0x401020
  401013:       6a 00                   push   0x0
  401015:       e8 00 00 00 00          call   0x40101a
  40101a:       ff 25 00 20 40 00       jmp    DWORD PTR ds:0x402000
  401020:       ff 25 08 20 40 00       jmp    DWORD PTR ds:0x402008

Upvotes: 6

user1129665
user1129665

Reputation:

You can have objdump on Windows, install MinGW, it's shipped with it among other tools:

> dir /b \MinGW\bin
addr2line.exe
ar.exe
as.exe
c++.exe
c++filt.exe
cc.exe
cpp.exe
dlltool.exe
dllwrap.exe
elfedit.exe
g++.exe
gcc.exe
gcov.exe
gdb.exe
gdbserver.exe
gprof.exe
ld.bfd.exe
ld.exe
libexpat-1.dll
libgcc_s_dw2-1.dll
libgmp-10.dll
libgomp-1.dll
libiconv-2.dll
libintl-8.dll
libmpc-2.dll
libmpfr-1.dll
libquadmath-0.dll
libssp-0.dll
libstdc++-6.dll
mingw-get.exe
mingw-get.exe~
mingw32-c++.exe
mingw32-cc.exe
mingw32-g++-4.6.2.exe
mingw32-g++.exe
mingw32-gcc-4.6.2.exe
mingw32-gcc.exe
mingw32-make.exe
mingwm10.dll
nm.exe
objcopy.exe
objdump.exe
pkginfo.exe
pthreadGC2.dll
quserex-test.exe
ranlib.exe
readelf.exe
size.exe
strings.exe
strip.exe
windmc.exe
windres.exe

>

Download it and installed, then setup the environment variables, see Environment Settings part on the Getting Started page.

Upvotes: 1

Related Questions