Index
> Projects and Ideas > [IDEA] fdasm - FASM decompilerGoto page 1, 2 Next |
| Author |
|
|
vid 10 May 2006, 11:04
zhak: it's never 100% possible to retain original "modifiability", for example in code like "mov eax, label2 - label1", you see "mov eax, 123", but if you insert something between label2 and label1, then their distance will grow, but you will still have "mov eax,123".
Best solution i know about is IDA's - it combines automatical dissassembly with human logic. |
|||
10 May 2006, 11:04 |
|
|
Crukko 03 Jun 2006, 08:21
Hi zhak!
I did it.....i wrote the code to disasm and then you can use the source in fasm to obtain .exe..... It's only at the begin, and I found a workaround on what 'vid' wrote.... i'm still on FasmNG...only if I finish work on this I'll put this feature in the editor.... bye... |
|||
|
03 Jun 2006, 08:21 |
|
|
vid 03 Jun 2006, 21:50
what workaround?
using source to obtain .exe is compiling, not decompiling |
|||
|
03 Jun 2006, 21:50 |
|
|
Crukko 04 Jun 2006, 14:08
if you decompile and obtain
'mov eax, 123' and '123' is label2-label1? how do you do? If the decompiler right recognize the label, then you can put whatever you whant between label 1 and 2.... that's all |
|||
|
04 Jun 2006, 14:08 |
|
|
LocoDelAssembly 04 Jun 2006, 14:37
If the executable has no debug info, how can the decompiler know that 123 is the difference between two labels?
|
|||
|
04 Jun 2006, 14:37 |
|
|
Crukko 14 Jul 2006, 10:09
loco: sometimes is possible....sometimes no
 |
|||
|
14 Jul 2006, 10:09 |
|
|
vid 14 Jul 2006, 13:03
Quote: Then generated source can be compiled again with fasm. Or the source can be modified first and then compiled. Quote: sometimes is possible....sometimes no when no, then first one cannot be satisfied... that's what we wanted to say |
|||
|
14 Jul 2006, 13:03 |
|
|
edfed 10 Oct 2006, 10:34
i want to code a decompiler too but if you make this, you must make a decompilation who can be compiled by fasm without modification
i your program don't make this, it's unuseable good luck |
|||
|
10 Oct 2006, 10:34 |
|
|
f0dder 10 Oct 2006, 10:39
edfed wrote: i want to code a decompiler too but if you make this, you must make a decompilation who can be compiled by fasm without modification It's impossible, with mathematical proof, to write something that works 100% all the time... hence why top-grade disassemblers are interactive. _________________  - carpe noctem |
|||
|
10 Oct 2006, 10:39 |
|
|
vid 10 Oct 2006, 11:47
f0dder: hehe, i can make proof that it is possible to work 100% times
and there goes the math... |
|||
|
10 Oct 2006, 11:47 |
|
|
f0dder 10 Oct 2006, 12:47
vid wrote: f0dder: hehe, i can make proof that it is possible to work 100% times I'd love to see you disprove the halting problem  _________________ - carpe noctem |
|||
|
10 Oct 2006, 12:47 |
|
|
vid 10 Oct 2006, 13:37
solution is based on defintion of problem given
Quote: you must make a decompilation, which can be compiled by fasm without modification so you just decompile to flat binary containing just "db"s
you was answering to something else than question was |
|||
|
10 Oct 2006, 13:37 |
|
|
f0dder 10 Oct 2006, 14:45
vid wrote: solution is based on defintion of problem given I was answering based on what the poster likely meant... and you know that _________________ - carpe noctem |
|||
|
10 Oct 2006, 14:45 |
|
|
edfed 23 Oct 2006, 10:51
f0dder wrote:
nothing is impossible with informatics decompile in 'db' is a shit idea how can you make the difference beetwen a text and a quote? how do you analyse a code? the program must analyse the flat binary file by comparing the current byte,word,dword or else with a table the current byte is an index and it's like a command interpret who can say if it's coherent or not if the current byte corespond with a valid opcode, then it's probably an instruction but if the following byte don't give a valid result then the current byte is a 'db' but it's probably more complex i want a decompiler fully compatible with fasm labels are names like 'a111:','a112:' etc the function search in fasm is good for this |
|||
|
23 Oct 2006, 10:51 |
|
|
edfed 24 Oct 2006, 10:42
forget the idea of small and quick
because it's a translator near to IA that you must code |
|||
|
24 Oct 2006, 10:42 |
|
|
edfed 07 Nov 2006, 11:49
you should download 'BXD2.com'
you'll see that it's possible |
|||
|
07 Nov 2006, 11:49 |
|
|
ATV 10 Nov 2006, 08:16
I have been throwing coin should I post this Turbo Pascal source of my disassembler.
Last year I was trying to add fasm syntax, but its not good. It's designed for DOS com files. At least it shows how not to do it.
|
|||||||||||
|
10 Nov 2006, 08:16 |
|
|
edfed 30 Nov 2006, 12:02
it's a good begin
now the decompiler must execute the program in emulation mode and find the data and code areas the principle should be simple make a copy of the source and use this as flags i explain: if the current data is an instruction executed, the flag should be set as 'c' if the current instruction is a j** then you should test the two ways and if the instruction is a call [ptr] or call reg you should find the totality of possible ways after this, the entire copy of the code will be set with valid flags if the flag is not set, it is a data area so you will put some db,dw,dd... before the data in hexadecimal the manner to determine the data format is simple, if a load or store is done with some register or immediate value, you can say it's a byte, a word, a string... see you in ten years |
|||
|
30 Nov 2006, 12:02 |
|
|
RedGhost 01 Dec 2006, 10:31
I have to agree with vid and f0dder, I do a lot of RCE. Without guesses/prediction knowing whats what with labels and procedures (not including, import/exports and functions that have been referenced with calls) is not an easy task, especially not without debugging symbols. If you want to recreate IDA/OllyDbg go ahead but it won't be an easy task.
But if you are going to, please make it faster than IDA is currently _________________ redghost.ca |
|||
|
01 Dec 2006, 10:31 |
|
| Goto page 1, 2 Next < Last Thread | Next Thread > |
Forum Rules:
|