7

I'm not looking for a tool that can magically create good code out of binary files, just something that makes assembly a little easier to read. For example, it would turn add eax,eax lea eax,[eax+eax*4] into eax *= 10; and test eax,eax JE <address> into if(eax == 0) goto <address>;. It doesn't even have to decompile the whole file into recompilable code, I would be happy if it would simply display pseudocode comments behind the easily decompilable lines of the disassembled code. Heck, it doesn't even need to be able to disassemble binaries in the first place as long as I can just feed it ASM code myself.

I've been searching for something like this for a while now and the only tools I've found (C4Decompiler, Boomerang, JustDecompile, ExeToC and REC) are completely useless because they all aim high and fail at the most basic things. In particular, they all fail (at least) one of the following requirements:

  • Free, stable and runs on Win7
  • Decompiles i386 ASM
  • Decompiles non-executable files such as DLLs
  • Displays decompiled code in a single view (not just tree structure)
  • Shows which ASM instructions (roughly) correspond to which segment of the decompiled code

I've found an excellent disassembler in PE Explorer that does everything right (except being free). I realize that decompiling is somewhat more complex than disassembling, but I actually just need a tool that helps with reading ASM code. That shouldn't be so hard to find, right?

Edit: For more clarification, a decent tool would display something like this:

+----------+--------------+-----------------------+------------------+
| 00001000 | 85C0         | test  eax,eax         | if (eax == 0)    |
+----------+--------------+-----------------------+   goto 0x100D    |
| 00001002 | 0F84FB030000 | je    0x0000100D      |                  |
+----------+--------------+-----------------------+------------------+
| 00001008 | 01C0         | add   eax,eax         | eax = eax * 10   |
+----------+--------------+-----------------------+                  |
| 0000100A | 8D0480       | lea   eax,[eax+eax*4] |                  |
+----------+--------------+-----------------------+------------------+
| 0000100D | 83C00F       | add   eax,0xF         | eax = eax + 15   |
+----------+--------------+-----------------------+------------------+

Or even like this:

+----------+--------------+-----------------------+------------------+
| 00001000 | 85C0         | test  eax,eax         | if (eax != 0)    |
+----------+--------------+-----------------------+   eax = eax * 10 |
| 00001002 | 0F84FB030000 | je    0x0000100D      |                  |
+----------+--------------+-----------------------+                  |
| 00001008 | 01C0         | add   eax,eax         |                  |
+----------+--------------+-----------------------+                  |
| 0000100A | 8D0480       | lea   eax,[eax+eax*4] |                  |
+----------+--------------+-----------------------+------------------+
| 0000100D | 83C00F       | add   eax,0xF         | eax = eax + 15   |
+----------+--------------+-----------------------+------------------+

It's the rightmost column that's of interest to me.

  • Can you add a screenshot of PE Explorer showing the rightmost column? – Franck Dernoncourt Jul 20 '14 at 16:51
  • PE Explorer doesn't have that column; it's just a disassembler, not an actual decompiler. That's my whole problem. – And G Jul 22 '14 at 11:30
3

Olly debugger is helpful, it is freeware, and is the best possible software; I recommend it over Hex-rays IDA pro(worth $400-$500). But one thing is for sure you really need to fasten your buckle to handle all the subroutines and functions if you are going to assemble the code your self. ( A YES it includes everything or MORE you demanded a software to do. )

  • I had a look at Olly Debugger, and it seems to be quite powerful indeed. However, I'm not looking for a simple disassembler, I'm looking for a tool that makes ASM code a little more readable, e.g. by displaying pseudocode for common arithmetic operations, and Olly Debugger does not seem to do that. Or do I have to configure this via some hidden settings first? – And G Jul 20 '14 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.