search

GrammaTech / ddisasm

A fast and accurate disassembler
https://grammatech.github.io/ddisasm/
GNU Affero General Public License v3.0
647 stars 59 forks source link

add basic PE support #19

Closed Trass3r closed 3 years ago

Trass3r commented 3 years ago

Proof of concept for #11. Feel free to take it further.

aeflores commented 3 years ago

Hi @Trass3r, thanks for your contribution! We are actually working on this right now! We plan to merge some initial PE32 support to the public branch in the coming weeks.

The general structure will be similar to your proof of concept, but there is a bunch of other stuff that needs to be take care of. E.g. import, export, RVA addressing... I will let you know when this gets merged. Stay tunned!

Trass3r commented 3 years ago

Yeah relocations are not handled as you don't need them to get started with executables. Neither are import or exception tables. Still in the end a simple hello world test (i686-w64-mingw32-g++ -O2 -g -fno-exceptions -ffunction-sections -fdata-sections -Wl,--gc-sections test.cpp -o test) got disassembled but had some artifacts like references in code such as cmp WORD PTR [+.L_408000-32768],23117 with .L_408000 being the start of .data, some sections didn't have .section directives (only labels) and there were no function directives (only labels). It also disassembled what looks like padding bytes as instructions:

            jmp .L_401060

            lea ESI,DWORD PTR [ESI]
            lea ESI,DWORD PTR [ESI]
            nop
.L_401120:

And in other cases NOPs are inserted as data:

            jmp DWORD PTR [+.L_408030]
          .byte 0x90
          .byte 0x90
          .byte 0x90
          .byte 0x90
          .byte 0x90
          .byte 0x90

            nop
            nop
            nop
            nop
kwarrick commented 3 years ago

As per https://github.com/GrammaTech/ddisasm/issues/11#issuecomment-790011412, we have just released support for both 32-bit and 64-bit Windows PE binaries!

Support is limited to the MASM assembler at present. Help with additional assembly syntaxes (i.e. for mingw-64) would be greatly appreciated at the gtirb-pprinter project.

Thank you!