Re: Reverse engineering != piracy (was Re: RosAsm disassembler output vs. IDA Pro)

From: Gerhard W. Gruber (sparhawk_at_gmx.at)
Date: 01/26/04 

Date: Mon, 26 Jan 2004 20:17:37 +0100

On 25 Jan 2004 20:32:22 GMT wrote Betov <betov@free.fr> in alt.lang.asm with
<XnF947BDEBA79024betovfreefr@213.228.0.33>

>3) When a programmer means to switch from any other Language
>to Asm, he may like to recover some of his previous works
>in Assembly. Such a Tool is supposed to make this very
>easy (and, by the way,... very pedagogic).

Today I was thinkning about this disassembler approach and suddenly I noticed
what it is, what makes it really hard to use this as a recignized feature for
code reusage. Even if you manage to disassemble perfectly, so that you can
discern all data and all code you still face a major problem. You can't
disassemble structures and constants.
One of the main features of a symbolc assembler is to have names for values.
i.E. O_RDWR for one of the open flags. So if your disassembler could also
recognice which function call you are calling, and from that determine which
name a value equeates to, you still have the problem of userdefined values and
of course structures. If a function takes a structure as an argument, but the
caller only filles some values of it, you can never determine how large the
structure should be. This means that you will very often produce code which is
simply wrong.

>
>4) Inside the Open Sources Mouvement, translating, say, a
>C App to Asm is not a so trivial task. It is, anyway, always

C to ASM is VERY easy. :) Every compiler can do this, so you will have a
syntactical correct assembler sourcefile. The other way around is the problem.
Actually I use this feature of C compiler very often when I have to hunt bugs
which I can't find otherwise. I already found two bugs in Visual C where it
created wrong code. In such a case I usually turn on the assembler output and
examine that to get all the symbols, adresses and of course the code itself.

>a _long_ task to do this by hand. In many cases, RosAsm
>Disassembler will do this in a couple of seconds, with
>recovering all of the original PE components at once. Not
>so bad... ;)

The PE content is rather boring. What is interesting, from a coder point of
view, is all the values and this stuff, because that is what you usually
include via include files. 

-- 
Gerhard Gruber
Maintainer of
SoftICE for Linux - http://pice.sourceforge.net/
Fast application launcher - http://sourceforge.net/projects/launchmenu

Relevant Pages

  • Re: Reverse engineering != piracy (was Re: RosAsm disassembler output vs. IDA Pro)
    ... because I read some BASIC programming book, which had a few lines assembler ... programmed in ASM, direclty into memory usualy, without so fancy things like ... RosAsm Syntax then he has HLL code in RosAsm syntax. ... Even if you disassembler will work perfectly, ...
    (alt.lang.asm)
  • Re: A valid number of prefixes
    ... it is likely to work more accurately than the disassembler (as in, ... (it decodes opcodes into structs, ... could also be applied to my assembler, mostly in order to allow cleaner ... this could help some with something like "portable ASM". ...
    (comp.lang.asm.x86)
  • Re: HLA v2.x and / or LASM suggestion: Win32 Resources
    ... Assembler" probably always get when people are actually talking about ... machine_ from ASM or even some of the more "low-level" C programming - ... "Abstraction" - as I keep saying and, one day, I Hope people will ... writing code thinking it's "portable" when, in fact, it contains ...
    (alt.lang.asm)
  • Re: What micros do you actually hate to work with?
    ... with less than tiny asm ... hassle to work with 32 bit longs in assembler for an 8 bit uP, ... Microchip's C compiler tools and their assembly under MPLAB. ... In this case, also, I was the only programmer. ...
    (comp.arch.embedded)
  • Re: maz v. taz
    ... Master the Power Basic Programmer! ... difficult and inconvenient to use a separate editor, ... Those who want to use your assembler (why? ... disassembler didn't live up to expectations, ...
    (alt.lang.asm)
Loading