Windows disassembler: looking for a tool...

Question

Hello.

I'm looking for a (preferably free) tool that can produce "proper" disassembly listing from a (non-.NET) windows PE file (*.exe or *.dll).

Important requirement: it should be possible to run the listing through a windows assembler (nasm, masm or whatever) and get working exe again (not necessarily identical to original one, but it should behave in the same way).

Intended usage is adding new subroutines into existing code, when source is not available.

Ideally, tool should be able to detect function/segment boundaries, API calls, and generate proper labels for jumps (I can live without labels for loops/jumps, though, but function boundary detection would be nice), and keep program resources/segments in place.

I'm already aware of IdaPRO(not free), OllyDBG (useful for in-place hacking, doesn't generate disassembly listing, AFAIK), ndisasm (output isn't suitable for assembler), dumpbin (useful, but AFAIK, output isn't suitable for assembler) and "proxy dll" technique.

Ideas? Or maybe there is a book/tutorial that explains some kind of alternative approach?

Answer 1

I'm not positive it does exactly what you want but have you tried PEiD?

Answer 2

You say you're aware of IdaPRO, but are you also aware of IdaFree?

Answer 3

Also,check out Oilly. It's a pretty neat application and very intuitive too. You can disassemble and hex edit. Ideal for small to medium size projects.