Re: Looking for a Library Disassembler for X86
- From: Terence <spamtrap@xxxxxxxxxx>
- Date: Thu, 13 Dec 2007 19:56:26 -0800 (PST)
The experience I have with libraries is that they contain .obj
routines for linking on demand into a program that call these
routines.
Each .obj module contains the names of entry points, the names of the
segments each part of the code belongs to, a table of addresses in the
following machine code to be adjusted after assigning the relative
address within the linked code, and then the machinei code itself,
using identification numbers instead of addresses.
This is a simplification of course; so I hope you get the idea.
If you take a small object module and open it with a binary editor or
binary dump program, and then examine the hex characters that form the
object module, you could quickly identify the diffeennt sections see
what the rues are and how to write a parser to reconstruct machine
code in a form which a dissembler can then handlese directly.
Here's an example.The routine uses DOS services to move the cursor,
write a string in background/foreground colours, on the screen at Y,X
and then place the cursor where it was or at the string start.
In line 1 is the name with the characer count (4) in front
04 4F 55 54 53
Before and after is 06 00, (6) then the count then the 4 characters,
then a check (98).
Then another entry starting 08 00 then the string, and so on.
<00> 80 06 00 04 4F 55 54 53 2B 96 08 00 00 05 53 4F
<10> 55 54 53 BF 98 07 00 60 8C 00 02 01 01 71 A0 90
<20> 00 01 00 00 55 8B EC 55 B4 03 33 DB CD 10 C4 5E
<30> 16 26 8B 07 A8 04 75 06 C4 5E 0E 26 8B 17 C4 5E
<40> 0A 26 8B 0F C4 5E 12 26 8B 1F C4 6E 06 52 50 A8
<50> 02 75 20 B4 02 CD 10 42 80 FA 50 75 04 81 C2 B0
<60> 00 58 50 26 8A 46 00 51 B9 01 00 CD 10 59 E2 E3
<70> EB 1F 90 B4 02 CD 10 42 80 FA 50 75 04 81 C2 B0
<80> 00 58 50 26 8A 46 00 45 51 B9 01 00 CD 10 59 E2
<90> E2 58 59 50 A8 01 75 02 8B D1 B4 02 CD 10 58 5D
<A0> A8 08 74 06 C4 5E 0E 26 89 17 8B E5 5D CA 14 00
<B0> 28 90 0B 00 00 01 04 4F 55 54 53 00 00 00 15 8A
<C0> 02 00 00 74
1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A
.
- Follow-Ups:
- Re: Looking for a Library Disassembler for X86
- From: Wolfgang Kern
- Re: Looking for a Library Disassembler for X86
- References:
- Looking for a Library Disassembler for X86
- From: R Karthick
- Looking for a Library Disassembler for X86
- Prev by Date: Re: writing a monitor
- Next by Date: Re: Looking for a Library Disassembler for X86
- Previous by thread: Looking for a Library Disassembler for X86
- Next by thread: Re: Looking for a Library Disassembler for X86
- Index(es):
Relevant Pages
|
|