From Collaborative RCE Tool Library
.NET Disassemblers
| Tool name: | IDA Pro |
| ||
|---|---|---|---|---|
| Author: | Ilfak Guilfanov | |||
| Website: | http://www.hex-rays.com/idapro | |||
| Current version: | 5.5 | |||
| Last updated: | June 15, 2009 | |||
| Direct D/L link: | N/A | |||
| License type: | Commercial | |||
| Description: | The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows or on Linux. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation. There is also a free (crippled) version available (IDA Pro Free). See its own entry in the library for more info. As of January 7, 2007, the official IDA Pro website moved from the old URL (http://www.datarescue.com/idabase) to the one listed above. | |||
| Also listed in: | Disassemblers, IPhone Tools, Linux Debuggers, Linux Disassemblers, Mobile Platform Debuggers, Mobile Platform Disassemblers, Ring 3 Debuggers, Symbian Tools | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | radare |
| ||
|---|---|---|---|---|
| Author: | pancake | |||
| Website: | http://www.radare.org | |||
| Current version: | 1.4.1 | |||
| Last updated: | November 3, 2009 | |||
| Direct D/L link: | http://radare.nopcode.org/get/radare-1.4.1.tar.gz | |||
| License type: | GPL | |||
| Description: | <nowiki>The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, arm and java with some ones powerpc. The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls. The debugger and disassembler has a code analysis module for x86, mips, arm and java. This way it's possible to draw graphs using Cairo on a GTK window or store the flow execution of a program on a log file and use the information to diff't against another trace or binary. The toolchain provides assemblers and disasemblers for x86, arm, mips (Loongson2F), sparc, CSR, m68k, powerpc, msil and java. The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so). The debugger is mainly developed on linux and {Net | |||
| Also listed in: | Assemblers, Binary Diff Tools, Code Injection Tools, Debuggers, Disassemblers, Hex Editors, Java Disassembler Libraries, Linux Debuggers, Linux Disassemblers, Linux Tools, Memory Dumpers, Memory Patchers, Process Dumpers, Reverse Engineering Frameworks, Ring 3 Debuggers, String Finders, Symbol Retrievers, SysCall Monitoring Tools, Tracers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Reflector for .NET |
| ||
|---|---|---|---|---|
| Author: | Lutz Roeder (current owner Red Gate Software) | |||
| Website: | http://www.red-gate.com/products/reflector | |||
| Current version: | 5.1.4.0 | |||
| Last updated: | July 18, 2009 | |||
| Direct D/L link: | http://downloads.red-gate.com/reflector.zip | |||
| License type: | Free | |||
| Description: | From website: "Reflector is a very powerful class browser, explorer, analyzer and documentation viewer for .NET. Reflector allows to easily view, navigate, search, decompile and analyze .NET assemblies in C#, Visual Basic and IL." This is one of the most powerful .NET decompilers that you can't buy - just download :) Many of the popular commercial tools achieving the same goal "suddenly" got a boost when this masterpiece of work saw a daylights (and besides that those are commercial, still have hard time with obfuscators). Just give it a try, it will last literally five minutes - load some well known assembly of yours, choose target .NET language (!) and let'em work. Then compare it with the original. You'll surely not forget this one. | |||
| Also listed in: | .NET Decompilers, Decompilers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | DisasMSIL |
| ||
|---|---|---|---|---|
| Author: | Daniel Pistelli | |||
| Website: | http://ntcore.com/Files/disasmsil.htm | |||
| Current version: | 1.0 | |||
| Last updated: | April 30, 2008 | |||
| Direct D/L link: | http://ntcore.com/Files/disasmsil/DisasMSIL.zip | |||
| License type: | Free / Open source | |||
| Description: | DisasMSIL is a free/open disasm engine for the Microsoft Intermediate Language (MSIL). You can use it any context you wish. There are no license restrictions. The only thing I ask you to do is to send me your bug fixes (if any). Note: Don't rely on the ECMA specification (Partition III: Common Language Infrastructure), since it's incomplete. Some new opcodes were introduced with the .NET Framework 2.0. | |||
| Also listed in: | .NET Disassembler Libraries | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | DotFuckScator v1.3 |
| ||
|---|---|---|---|---|
| Author: | LibX | |||
| Website: | http://www.reteam.org/tools.html | |||
| Current version: | v1.3 | |||
| Last updated: | May 9, 2009 | |||
| Direct D/L link: | http://reteam.org/tools/tf35.zip | |||
| License type: | Free | |||
| Description: | DotFuckScator.V1.3 DotFuckScator is a reversing engineering tool used to remove string encryption from dotfuscator protected files If the original file was strong name signed DotFuckScator will create a new keypair and re-sign the file with this pair, be carefull since file depending on this file will need to be edited manualy to support the new strong name signature. You can use RE-Sign for this and the editor of your choice Also if you like the file re-signed with a specific key place your key in the same folder as the file you are about to process and rename it to DotFuckScator.snk now DotFuckScator will use this key for the re-sign process. Hope this tool is of any use Changes: * v1.1 has a minor bugfix that prevented some strings from proper decrypting * v1.2 small bugfix in re-signing, added indicator to show the amount of strings decrypted so far * v1.3 Fixed royal fuck-up in string decryption code replacement function meaning the output will now run after string decryption removal ;x | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Dotnet IL Editor (DILE) |
| ||
|---|---|---|---|---|
| Author: | zsozsop | |||
| Website: | http://sourceforge.net/projects/dile | |||
| Current version: | 0.2.6 | |||
| Last updated: | September 30, 2007 | |||
| Direct D/L link: | N/A | |||
| License type: | Free / Open Source | |||
| Description: | Dotnet IL Editor (DILE) is an editor program which helps modifying .NET assemblies. It is intended to be able to disassemble .NET assemblies, modify the IL code, recompile it and run inside a debugger. | |||
| Also listed in: | .NET Debuggers, .NET Executable Editors | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | PEBrowse Professional |
| ||
|---|---|---|---|---|
| Author: | SmidgeonSoft | |||
| Website: | http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html | |||
| Current version: | 10.0.1 | |||
| Last updated: | July 12, 2009 | |||
| Direct D/L link: | http://www.smidgeonsoft.com/download/PEBrowse.zip | |||
| License type: | Free | |||
| Description: | PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others. (We have received reports that the software also works on other OSes, including Wine (!) and Windows CE.) With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse. The information is organized in a convenient treeview index with the major divisions of the PE file displayed as nodes. In most cases selecting nodes will enable context-sensitive multiple view menu options, including binary dump, section detail, disassembly and structure options as well as displaying sub-items, such as optional header directory entries or exported functions, that can be found as part of a PE file unit. Several table displays, hex/ASCII equivalents, window messages and error codes, as well as a calculator and scratchpads are accessible from the main menu. While the binary dump display offers various display options, e.g., BYTE, WORD, or DWORD alignment, the greatest value of PEBrowse comes when one disassembles an entry-point. An entry-point in PEBrowse is defined as: * Module entry-point * Exports (if any) * Debug-symbols (if a valid PDB, i.e., program database file, is present) * Imported API references * Relocation addresses * Internal functions/subroutines * Any valid address inside of the module Selecting and disassembling any number of these entry-points produces a versatile display rich in detail including upper/lowercase display, C/Pascal/Assembler suffix/prefixing, object code, color-coded statements, register usage highlighting, and jump/call target preview popups. Additional information, such as variable and function names, will also be present if one has access to a valid PDB file. Disassembly comes in two flavors: linear sweep (sequential disassembly from a starting address) and recursive traversal, aka, analysis mode (disassembly of all statements reachable by non-call statements - extended analysis disassembles all internal call statements as well). The latter mode also presents local variables with cross-referencing, highlighting, and renaming options. If one adds/changes variable name or adds comments to specific lines, these can be displayed in a session file which will record and save all currently opened displays. PEBrowse Professional will decompile type library information either embedded inside of the binary as the resource "TYPELIB" or inside of individual type libraries, i.e., .TLB or .OLB files. PEBrowse Professional also displays all metadata for .NET assemblies and displays IL (Intermediate Language) for .NET methods. It seamlessly handles mixed assemblies, i.e., those that contain both native and managed code. Finally, PEBrowse can be employed as a file browse utility for any type of file with the restriction that the file must be small enough that it can be memory-mapped. | |||
| Also listed in: | .NET Tools, COM Tools, Delphi Tools, Disassemblers, Exe Analyzers, Memory Dumpers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
