Disassembly tools

Tools:

• objdump is often preinstalled
• tools with UI: IDA Pro, Ghidra (free, comes from the NSA)
• Hopper for Mac
• radare2

objdump:

• linear sweep disassembler, assumes everything is code
• no analysis
• assumes headers are correct, likely won’t be in malicious binaries
• flags: -M intel (intel syntax), -d (disassemble executable sections), -D (disassemble all sections)

IDA Pro:

• recursive traversal disassembler
• interactive and scriptable, with built-in debugger
• it’s expensive if you want the Hex-Rays decompiler
• it’s inconvenient to use, based in the DOS days
• there’s no undo (in free and older versions)

Ghidra:

• also recursive traversal
• released by NSA in 2019
• open source, free
• has a decompiler, supports undo

Binary patching

• modify instructions
  • nop code to disable it
  • modify data
• you can only replace bytes bu:
  • too small: pad replacement with nops
  • too large: jump elsewhere with more space, jump back later
• to export from ghidra: script manager, need a script for this
• to patch data, go window→bytes and click the pencil button at the top