flat assembler
Message board for the users of flat assembler.

Index > Windows > utility to dump dll to asm code, function name as comment?

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
is there any such "open source" utility to dump dll / exe into assembly language code, with exported & calling functions name commented side.

because i want to see how a function inside dll doing its job.

i tried loading ollydebug, but i kinda lost using that debugger,

i guess, what i need is more simpler, dump and save into text file, then i read it as a near asm source file.

is something like that already available?
Post 14 Feb 2014, 09:43
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17450
Location: In your JS exploiting you and your system
revolution
Perhaps my website can help you?

BTW: If you can't follow the debugger then I think you will have the same trouble with a disassembled text file also.
Post 14 Feb 2014, 09:53
View user's profile Send private message Visit poster's website Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
Have you tried IDApro already? If not it is not precisely a tool to save as text file, but worth trying to analyze the functions of interest nonetheless.

There is also HexRays which decompiles to C in case you find it more easy to grasp, but I'm afraid that there is no even a trial license for it.
Post 14 Feb 2014, 11:42
View user's profile Send private message Reply with quote
HaHaAnonymous



Joined: 02 Dec 2012
Posts: 1180
Location: Unknown
HaHaAnonymous
[ Post removed by author. ]


Last edited by HaHaAnonymous on 28 Feb 2015, 18:13; edited 1 time in total
Post 14 Feb 2014, 13:03
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
LocoDelAssembly wrote:
…but I'm afraid that there is no even a trial license for it.
Fear not, there is IDA Freeware, currently 5.0.

While being quite limited (Win32 GUI version, x86 disassembly only), it could be useful because loader set is pretty good (PE/ELF/OMF/COFF and some others); OTOH, signatures and type libraries are dated back in 2010. I don't remember whether it support symbol server.

There is IDA Demo (6.5) too, whose limitations are of another kind (it's time-limited and wouldn't save database).

P.S. HaHaAnonymous, that's what private messages are for.
Post 14 Feb 2014, 14:54
View user's profile Send private message Reply with quote
HaHaAnonymous



Joined: 02 Dec 2012
Posts: 1180
Location: Unknown
HaHaAnonymous
[ Post removed by author. ]


Last edited by HaHaAnonymous on 28 Feb 2015, 18:13; edited 1 time in total
Post 14 Feb 2014, 14:59
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
OllyDbg can do this. Just open your DLL with it and select DLL Exports, click follow and it'll take you to the first instruction of that function.
Post 14 Feb 2014, 16:59
View user's profile Send private message Reply with quote
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
revolution wrote:

Perhaps my website can help you?

i always revo,
yep, my mistake, i need to allocate more time into learning how to debug and disassembly,

typedef wrote:

OllyDbg can do this. Just open your DLL with it and select DLL Exports, click follow and it'll take you to the first instruction of that function.

http://www.ollydbg.de/Loaddll.htm
Single step event at ntdll.77B001B8 - use Shift+F7/F8/F9 to pass exception to program
then i press Shift+F9, restart and try again with Shift+F8, then Shift+F7
Debugged program was unable to process exception.
it dosn't seem working.

baldr wrote:
Fear not, there is IDA Freeware, currently 5.0.

i heard about this tool long time ago, but never really use it,
will revo to see how to use this tool, thanks.

btw, anyone using windbg? from microsoft,
http://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx

or, one more question,
does anyone here, program professionally for years and never use debugger?
maybe he got another tricks or magics beside debugger?
Post 14 Feb 2014, 18:00
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
sleepsleep wrote:
does anyone here, program professionally for years and never use debugger?
maybe he got another tricks or magics beside debugger?
Debuggers seem to be inherently interactive tools, so I may recall my experience with punched-tape-loaded Pong version of mine for GRAFOR-capable vector-graphic terminal (which itself was a weird tandem of LSI-11 compatible Elektronika-60).

Everytime program behaves strange, I'd inserted some output routines in the program flow to display critical values (in the end almost entire display center was filled with ticking numbers; my colleagues decide to prefer debug versions because playing them was looking so nerdish, and their tapes were about 0.5m longer ;-)

WinDbg is good at analyze -v for crash dumps. It uses symbol server too.

IDA is a quite simple tool (key word: "interactive", but undo is unavailable), and powerful if you master it. There are lots of tutorials on it, grab some and join the wonderful world of reverse engineering. ;-)

P.S. revolution, it seems that I was the #10600 idiot served. ;-)
Post 14 Feb 2014, 19:33
View user's profile Send private message Reply with quote
HaHaAnonymous



Joined: 02 Dec 2012
Posts: 1180
Location: Unknown
HaHaAnonymous
[ Post removed by author. ]


Last edited by HaHaAnonymous on 28 Feb 2015, 18:11; edited 1 time in total
Post 14 Feb 2014, 19:38
View user's profile Send private message Reply with quote
baldr



Joined: 19 Mar 2008
Posts: 1651
baldr
HaHaAnonymous wrote:
A debugger is not a mandatory tool in programming…
I have to object, debugging skills are crucial for any serious programmer (if (s)he is not error-prone Wink). There were times when run-time was precious, thus perfect code was a valued treasure (but we didn't even touch it).

Can you withstand this?
Post 14 Feb 2014, 20:55
View user's profile Send private message Reply with quote
HaHaAnonymous



Joined: 02 Dec 2012
Posts: 1180
Location: Unknown
HaHaAnonymous
[ Post removed by author. ]


Last edited by HaHaAnonymous on 28 Feb 2015, 18:11; edited 1 time in total
Post 14 Feb 2014, 21:03
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
baldr wrote:
LocoDelAssembly wrote:
…but I'm afraid that there is no even a trial license for it.
Fear not, there is IDA Freeware, currently 5.0.
Oh that is brand new information! Wink
LocoDelAssembly wrote:
There is also HexRays which decompiles to C in case you find it more easy to grasp, but I'm afraid that there is no even a trial license for it.
Hex-Rays Decompiler
Post 14 Feb 2014, 22:27
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
sleepsleep wrote:
is there any such "open source" utility to dump dll / exe into assembly language code, with exported & calling functions name commented side.

because i want to see how a function inside dll doing its job.

i tried loading ollydebug, but i kinda lost using that debugger,

i guess, what i need is more simpler, dump and save into text file, then i read it as a near asm source file.

is something like that already available?



typedef wrote:
OllyDbg can do this. Just open your DLL with it and select DLL Exports, click follow and it'll take you to the first instruction of that function.


sleepsleep wrote:
Single step event at ntdll.77B001B8 - use Shift+F7/F8/F9 to pass exception to program
then i press Shift+F9, restart and try again with Shift+F8, then Shift+F7
Debugged program was unable to process exception.
it dosn't seem working.


See what you're doing wrong? You're debugging the DLL. Your problem was to know how a DLL works by looking at its code. Well, the steps I gave you will do just that. But if you want to debug the DLL you'll have to debug the .EXE that loads it so you can see it in action. In the example you linked, the DLL being debugged was made for that reason that's why it works perfectly withe the DLL loader. Your DLL probably expects something else other than a pointer to "Hello World". That's why it crashed.

1. Open your DLL in OllyDbg, the loader will load your DLL.
2. Select Debug > Call DLL export
3. Select the function you want to view.
4. Right click on the function and select Edit > Select procedure (The whole proc will be selected)
5. Right click anywhere on the selected code and select Edit > Copy as table
6. Paste your assembly in any editor.

NOTE: Any debugger will put comments if its analysis finds references. If it can't there won't be any. It's as simple as that.
Post 14 Feb 2014, 23:12
View user's profile Send private message Reply with quote
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
typedef wrote:
1. Open your DLL in OllyDbg, the loader will load your DLL.
2. Select Debug > Call DLL export

i can't pass through step 2, with the error i mentioned above

the dll is publicly available here,
http://www.tscprinters.com/cms/upload/download_en/TSCLIB_V0201_x86.zip
it doesn't work with your suggested steps,

baldr wrote:

Debuggers seem to be inherently interactive tools, so I may recall my experience with punched-tape-loaded Pong version of mine for GRAFOR-capable vector-graphic terminal (which itself was a weird tandem of LSI-11 compatible Elektronika-60).

wow, i wasn't on earth yet during that time,
Post 15 Feb 2014, 01:51
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
sleepsleep
Either you're doing it wrong or your OllyDbg installation is messed up.


http://imgur.com/HGl8TBM,XGSHFNG,RaC9qOj

PS: There are 3 pictures there.
Post 15 Feb 2014, 04:51
View user's profile Send private message Reply with quote
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
weird, how come it works on your site, but failed on my site???
i am using win7 64bit, is that issue?
Post 15 Feb 2014, 06:28
View user's profile Send private message Reply with quote
typedef



Joined: 25 Jul 2010
Posts: 2913
Location: 0x77760000
typedef
During the 2nd step nothing is executed, so either you are clicking the wrong button or your OllyDbg version is different.

Windows 7 64bit Ultimate
OllyDbg v2.01
Post 15 Feb 2014, 14:56
View user's profile Send private message Reply with quote
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
i downloaded v2.01, it works now!!!!
i could see the magic inside, wow, =) wow =)

thanks typedef!
Post 15 Feb 2014, 20:18
View user's profile Send private message Reply with quote
sleepsleep



Joined: 05 Oct 2006
Posts: 8999
Location: ˛                             ⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣⁣Posts: 334455
sleepsleep
hi all,
any suggestion to debug Visual Basic 6 application,
i got one in my hand,
it seems that the author of the application program it to generates a real serial number based on system key to match our input serial number, kinda weird, but maybe this is how all those serial verification works.

so, his generated genuine serial is actually shown (if one go through ollydbg)
if genuine_serial == input_serial then.
....

but i feel it is kinda hard to step through a VB application using ollydbg, any suggestion?
Post 03 Feb 2015, 15:58
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.