Assemblers And Disassembler Softwares Computer Science Essay

Assemblers And Disassembler Softwares Computer Science EssayA disassembler is a computer schedule that translates machine language into assembly language the inverse operation to that of an assembler . A disassembler differs from a decompiler which targets a high-level language rather than an assembly language. The output of a disassembler is often formatted for human-readability rather than suitability for input to an assembler, do it principally a reverse-engineering tool.Assembly language source compute generally permits the use of constants and programmer comments . These are usually removed from the assembled machine order by the assembler . A disassembler operating on the machine cipher would produce disassembly lacking these constants and comments. The disassembled output becomes more difficult for a human to come across than the original annotated source code. Some disassemblers make use of the symbolic debugging information present in object agitates such as ELF. T he Interactive Disassemblerallow the human user to make up mnemonic symbols for values or regions of code in an interactive session human insight applied to the disassembly process often parallels human creativity in the code writing process.Disassembly is not an exact science On CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is realizable for a single program to deliver two or more reasonable disassemblies. Determining which instructions would actually be encountered during a lick of the program reduces to the proven-unsolvable halting problem.Examples of disassemblersAny interactive debugger bequeath include some way of viewing the disassembly of the program being debugged. Often, the same disassembly tool will be packaged as a standalone disassembler distri preciselyed along with the debugger. For example, objdump, part of GNU Binutils, is related to the interactive debugger gdb . The some ofexample of dissembler areIDAILDASM i s a tool contained in the .NET Framework SDK. It can be used to disassemble PE files containing Common Intermediate Language code.OllyDbg is a 32-bit assembler level analysing debuggerPVDasm is a Free, Interactive, Multi-CPU disassembler.SIMON a test/ debugger/ vitaliser with integrated dis-assembler for Assembler, COBOL and PL/1Texe is a Free, 32bit disassembler and windows PE file analyzer.unPIC is a disassembler for PIC microcontrollersInteractive DisassemblerInteractive DisassemblerThe Interactive Disassembler, more commonly known as simply IDA, is a disassembler used for reverse engineering. It supports a variety of executable formats for different processors and operating systems. It similarly can be used as a debugger for Windows PE, Mac OS XMach-O, and LinuxELF executables. A decompiler plugin for programs compiled with a C/C++compiler is available at extra cost. The latest full version of Ida Pro is commercial.IDA performs much automatic code analysis, using cross-referen ces between code instalments knowledge of parameters of API calls, and other information. However the nature of disassembly precludes total accuracy, and a great deal of human intervention is inescapably required. IDA has interactive shareality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and viceversa.ScriptingIDC scripts make it possible to extend the operation of the disassembler. Some helpful scripts are provided, which can serve as the basis for user written scripts. most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the take to the woods names of the original source code. There are websites devoted to IDA scripts and offer assistance for frequently arising problems.Users have created plugins that allow other common scripting languages to be used instead of, or in add ition to, IDC. IdaRUB supports Ruby and IDAPython adds support for PythonSupported systems/processors/compilersOperating systemsx86WindowsGUIx86 Windows consolex86 Linux consolex86 Mac OS X outgrowth Windows CEExecutable file formatsPE (Windows)ELF (Linux, most *BSD)Mach-O (Mac OS X)Netware .exeOS/2 .exeGeos .exeDos/Watcom LE executable (without embedded dos extender)raw binary, such as a strict storage imageProcessorsIntel 8086 familyARM, including thumb codeMotorola 68xxx/h8ZilogZ80MOS Technology 6502Intel i860DEC AlphaAnalog Devices ADSP218xAngstrem KR1878Atmel AVR seriesDEC series PDP11Fujitsu F2MC16L/F2MC16LXFujitsu FR 32-bit FamilyHitachi SH3/SH3B/SH4/SH4BHitachi H8 h8300/h8300a/h8s300/h8500Intel 196 series 80196/80196NPIntel 51 series 8051/80251b/80251s/80930b/80930sIntel i960 seriesIntel Itanium (ia64) seriesJava virtual machineMIPS mipsb/mipsl/mipsr/mipsrl/r5900b/r5900lMicrochip PIC PIC12Cxx/PIC16Cxx/PIC18CxxMSILMitsubishi 7700 Family m7700/m7750Mitsubishi m32/m32rxMitsu bishi m740Mitsubishi m7900Motorola DSP 5600x Family dsp561xx/dsp5663xx/dsp566xx/dsp56kMotorola ColdFireMotorola HCS12NEC 78K0/78K0SPA-RISCPowerPCSGS-Thomson ST20/ST20c4/ST7SPARC FamilySamsung SAM8Siemens C166 seriesTMS320Cxxx seriesCompiler/libraries (for automatic library function recognition)3Borland C++ 5.x for DOS/WindowsBorland C++ 3.1Borland C Builder v4 for DOS/WindowsGNU C++ for CygwinMicrosoft CMicrosoft QuickCMicrosoft Visual C++Watcom C++ (16/32 bit) for DOS/OS2ARM C v1.2GNU C++ for Unix/commonSIMON (Batch Interactive test/debug)SIMON (Batch interactive test/debug) was a proprietary test/debugging toolkit for interactively testing Batch programs designed to run on IBMs System 360/370/390 architecture.It operated in two modes, one of which was full instruction set simulator mode and provided Instruction step, conditional Program Breakpoint (Pause) and storage alteration features for Assembler, COBOL and PL/1 programs.High level language (HLL) users were also able to see an d modify variables straightway at a breakpoint by their symbolic names and set conditional breakpoints by data content.Many of the features were also available in partial monitor mode which relied on deliberately interrupting the program at pre-defined points or when a program check occurred.In this mode, processing was not significantly different from normal processing speed without monitoring.It additionally provided features to prevent application program errors such as Program Check, Wild branch , and Program loop. It was possible to correct many errors and interactively alter the control flow of the executing application program. This permitted more errors to be detect for each compilation which, at the time, were often scheduled batch jobs with printed output, often requiring several hours turnaround before the next test run.Operating SystemsSimon could be put to death on IBMMVS, MVS/XA, ESA or DOS/VSE operating systems and required IBM 3270 terminals for interaction with th e application program.LIDAlida is basically a disassembler and code analysis tool. It uses the poops libdisasm for single opcode It allows interactive control all over the generated deadlisting via commands and builtin tools.featuresIt trace execution flow of binaryIt work with symbolic names interactive naming of functions, labels, commenting of code.It glance over for known anti-debugging, anti-disassembling techniquesIt scan for user defined code sequencesIt integrated patcherIt also integrated cryptoanalyzerMany disassemblers out there use the output of objdump lida that tries a more serious approach. The several limitations of objdump are broken by using libdisasm and by tracing the execution flow of the program.Further by having the control over the disassembly more features can be included. Everybody who has already worked on some deadlisting will immediate feel a need to work interactive with the code and be able to change it.Therefore lida will have an integrated patch er resolves symbolic names, provides the ability to comment the code, serves competent browsing methods. The more exotic features of lida should be on the analysis side. The code can be scanned for exercise sequences known antidebugging techniques known encryption algorithms also you will be able to directly work with the programs data and for example pass it to several made-to-orderizable en-/decryption routines.This of public life only makes limited sense as it is not a debugger. Tough often I really missed this functionality.Limitations of objdump based disassemblersUsual programs one would equivalent to disassemble are each coded directly in assembly, or use some tricks to avoid beeing disassembled. I will here give a sententious overview of the most objdump featuresobjdump relies on section headersIt is an ELF executable that contains correct section headers. Tough for the OS-loader to run an ELF binary, section headers are not necessary at all. The important thing to ge t a process loaded into memory are the program headers .So the first common anti disassembling trick is to either drop or manipulate the ELF section headers By doing so, objdump refuses to perform the disassemblyemailprotected file tiny-crackmetiny-crackme ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, corrupted section header sizingemailprotected objdump -D tiny-crackmeobjdump tiny-crackme File format not take indThe binary I took as example to verify is yanistos tiny-crackmeobjdump does not trace the execution flow IBy not tracing the execution flow objdump can easily be fooled to just disassemble a few lines and stop there.This means it does not recognize any functions, does not see the code which is stored in data sections.objdump does not trace the execution flowAdditionally another common trick is to stack away garbage opcodes and overjump them to disalign the disassembly from the execution flow.Example When an instruction jumps into the middle of the next instruction, objdump does not disassemble from this exact location. It will continue with the next instruction and consequently dissasemble garbage from here on.As a result you will mainly see totally usesless instructions in the whole disassembly.. Implementation Detailslida uses libdasm of the bastard for single opcode decoding. It does not use the whole environment including the typhoon database.The main program is coded in perl/TK which uses a C backend for the most timeconsuming parts (disassembly, analysis, scanning for strings). Generally lida is designed to be as fast as possible (the disassembly) by trying not to waste all your RAM lida is designed to be also efficient in usability. Therefore all important functions are accessible via single keystrokes, or short commands. This means no clicking around is necessary, you can enter your tasks directly into the commandline.The disassembling engineThe disassembling is do in currently 4 (or 6) passes, default is all 61st pass is the main control flow disassembly present the disassembly is started from the executables entrypoint, and recursivelydisassembles the binary by following each branch, and stepping into each sub-routine.This leads in also disassembling code blocks in data sections, if existent ),so the disassembly is not limited to a .text section.Also, if indirect jumps/calls are used, the final destination is looked upin the binaries data of course2nd pass for glibc binariesA heuristic scan scans for the main() function and starts pass1 there (so also re-cursive disassembling)3rd pass all other code sectionsThis pass repeats pass1 for all found executable sections, and starts at sectionstart. If the binary does not contain section headers, the disassembly startsat the first loaded executable address.4th pass functionsThis pass scans for typical function prologues and starts pass1 at each foundaddress. This is for discovering code regions which are not explicitly called,and where their entrypoints are evaluated at runtime.5th pass disassembling cavesAll passes build up a lay out of the binary. If until now there are code regionswhich were not yet disassembled, they can be now.6th pass remaindersIf pass 5 was executed, and there are good-tempered caves, they are displayed as DB xx, Definitely for pass 4 and 5 there are enhancements to come, as easy as for the recursive disassembly function itself.Also to mention whenever a jump into the middle of a previous instruction is beeing found,currently those addresses are beeing marked. To follow is a representation of instructions at bottom instructions (compare 3.1), as of course by intelligent placing of opcodes both instructions can be valid and used during the execution flow.Signature Scanning basically it is done by a signature scanning. I quote it because it is not a simple pattern matching.For understanding that, one needs a lowly understanding of typical hash-encryption algorythms.Lets take for example a MD 5 hash. How can we find the code that does an MD5 hash?On a very high level generating a hash is usually done in 3 steps the init function, the update function and the finalize function.The init function usually sets up an array of some mathematical values, which are then modified in a loop using the input data (plain data) during the algorythm, until the hash is calculated.The finalize function creates the representation in a common format (easily spoken it pads the digest and is appending the size).Hoewever, it does not matter to know actually how the algorythm works to find it Due to the common fact, that the initialization functions use fixed numeric initialization values, which are the same in every implementation, as they are part of the algorythm these are the values we are searching for. For MD5 those are0x674523010xefcdab890x98badcfe0x10325476So to find an MD5 implementation, it is necessary to scan for those dword values, of course they can appear in any order (strange e nough nearly always they are used in the listed order above). Now as those dwords can exist also in just any binary by accident (oltough seldom) some smarter scanning is done the values need to appear in a limited size of a code block. The values can be in any order, and also some fuzzyness has been added to scan for a little bit altered init values.Heuristic ScanningHeuristic scanning is not yet implemented. It is intended to find custom crypto code.Basically it is beeing looked for a sequence of suspicious opcode sequences, which look like an encryption routine.OllyDbg is an x86debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries. According to the programs help file, version 1.10 is the final 1.x release. Version 2.0 is in development and is being written from the ground up. The soft ware is free of cost, but the shareware license requires users to register with the author. The current version of OllyDbg cannot disassemble binaries compiled for 64-bit processors.