I'm not looking for a tool that can magically create good code out of binary files, just something that makes assembly a little easier to read. For example, it would turn add eax,eax
lea eax,[eax+eax*4]
into eax *= 10;
and test eax,eax
JE <address>
into if(eax == 0) goto <address>;
. It doesn't even have to decompile the whole file into recompilable code, I would be happy if it would simply display pseudocode comments behind the easily decompilable lines of the disassembled code. Heck, it doesn't even need to be able to disassemble binaries in the first place as long as I can just feed it ASM code myself.
I've been searching for something like this for a while now and the only tools I've found (C4Decompiler, Boomerang, JustDecompile, ExeToC and REC) are completely useless because they all aim high and fail at the most basic things. In particular, they all fail (at least) one of the following requirements:
- Free, stable and runs on Win7
- Decompiles i386 ASM
- Decompiles non-executable files such as DLLs
- Displays decompiled code in a single view (not just tree structure)
- Shows which ASM instructions (roughly) correspond to which segment of the decompiled code
I've found an excellent disassembler in PE Explorer that does everything right (except being free). I realize that decompiling is somewhat more complex than disassembling, but I actually just need a tool that helps with reading ASM code. That shouldn't be so hard to find, right?
Edit: For more clarification, a decent tool would display something like this:
+----------+--------------+-----------------------+------------------+
| 00001000 | 85C0 | test eax,eax | if (eax == 0) |
+----------+--------------+-----------------------+ goto 0x100D |
| 00001002 | 0F84FB030000 | je 0x0000100D | |
+----------+--------------+-----------------------+------------------+
| 00001008 | 01C0 | add eax,eax | eax = eax * 10 |
+----------+--------------+-----------------------+ |
| 0000100A | 8D0480 | lea eax,[eax+eax*4] | |
+----------+--------------+-----------------------+------------------+
| 0000100D | 83C00F | add eax,0xF | eax = eax + 15 |
+----------+--------------+-----------------------+------------------+
Or even like this:
+----------+--------------+-----------------------+------------------+
| 00001000 | 85C0 | test eax,eax | if (eax != 0) |
+----------+--------------+-----------------------+ eax = eax * 10 |
| 00001002 | 0F84FB030000 | je 0x0000100D | |
+----------+--------------+-----------------------+ |
| 00001008 | 01C0 | add eax,eax | |
+----------+--------------+-----------------------+ |
| 0000100A | 8D0480 | lea eax,[eax+eax*4] | |
+----------+--------------+-----------------------+------------------+
| 0000100D | 83C00F | add eax,0xF | eax = eax + 15 |
+----------+--------------+-----------------------+------------------+
It's the rightmost column that's of interest to me.