Mac Mac OS X x86 Disassembler

satans_banjo

macrumors regular
Original poster
Sep 12, 2005
218
0
SE London
Hi

I'm trying my hand at a bit of reverse engineering (purely for the challenge of it all) and I was wondering if there was a reliable x86 disassembler for Mac OS X (command line or otherwise, preferably free)

Thanks
 

caveman_uk

Guest
Feb 17, 2003
2,390
1
Hitchin, Herts, UK
You could try using gdb (only if you really want to become a gibbering wreck). I did read IDA Pro now ran on the mac but there's not much sign of it on their website (and it's not free). I guess you could check out fink for anything useful?
 

savar

macrumors 68000
Jun 6, 2003
1,952
0
District of Columbia
satans_banjo said:
Hi

I'm trying my hand at a bit of reverse engineering (purely for the challenge of it all) and I was wondering if there was a reliable x86 disassembler for Mac OS X (command line or otherwise, preferably free)

Thanks
gdb, definitely
 

satans_banjo

macrumors regular
Original poster
Sep 12, 2005
218
0
SE London
Thanks - I've got GDB installed, but how do I create a text output file with the assembly code? I can only seem to find out how to use it as a debugger
 

savar

macrumors 68000
Jun 6, 2003
1,952
0
District of Columbia
satans_banjo said:
Thanks - I've got GDB installed, but how do I create a text output file with the assembly code? I can only seem to find out how to use it as a debugger
i dont think you can disassemable the entire executable, but you can disassemble ranges of memory. i forget the exact command, i think "disassemble" works but so does "d" or "da" or something like that. gdb probably has help to teach you the mnemonics.

if you're interested in reverse engineering, it probably makes more sense to reverse engineer from gdb than to just dump an entire .asm file, because you can disassemble a particular function that you're interested in or even disassemble the instructions about to execute "disassemble pc pc+10" i think.

its been a while since i used gdb..there's a learning curve but its quite powerful. you can set actions to execute whenever a particular breakpoint is hit. this is real handy for "stubbing out" function calls. set a breakpoint on that function and then set the action to return to pc.

hope this helps
 

pip11

macrumors member
Apr 29, 2005
38
0
There aren't many options for disassemblers:

1) use otool, included with the dev tools. otool -tV will give you a pretty standard disassembly

2) ht editor--open source and supports OS X and mach-o. you have to compile and install it manually. Its interface can be confusing--use function keys to get to the main features, like F6 to change into the disassembly mode or hex editor.

3) IDA Pro--should work under wine/crossover, although maybe not perfectly. definitely not free, but it is the best. it supports x86 mach-o, and its graphing features are great, especially if you aren't too familiar with disassembly/x86 assembly (like me).
 

harlock59

macrumors newbie
Mar 23, 2006
9
0
france, europe
i am also looking for a disassembler (or debugging) program but not for x86, for powerpc under panther. thanks for any reply. or send me a message at: harlock59[at]gmail[dot]com .thanx a lot.

ps: if possible, not a line-command-only software, but with a graphical user interface (GUI).
 

Vanya

macrumors newbie
Oct 24, 2006
1
0
Not sure if this will help, but I wrote a "GDB Tutorial for Beginners" awhile back if you're interested-very beginner stuff but lots of information. I wrote it when I used a PowerPC Mac, so the code listings are for PowerPC primarily (with some intel bits thrown in). I'm updating it to reflect the intel cpu of my MacBook Pro. :)

Here it is.
Cheers!
John