| Сейчас на форуме: (+5 невидимых) |
 |
eXeL@B —› WorldWide —› KirbiDSMx64-OPS (Open Source 64 bit Disassembler) |
| Посл.ответ | Сообщение |
|
|
Создано: 09 мая 2018 11:35 · Поправил: Kirbiflint · Личное сообщение · #1 Hello everyone, In this release i'm going to share a my 64 bit Disassembler. Some months ago I released my KirbiDSM for x86 and it was written in C++\CLI .NET. KirbiDSMx64-OPS is re-made and the code is written in C\C++ and the UI is made in Qt. In this disassembler there are some more features which one of those is the .NET Decompiler plugin that is written in C# The idea to make an 64 disassembler it comes me because my passion of coding is always more good and my knowledge It is always more better I think. Another reason that i decided to make this Disassembler, it is that i'm inspired of x64dbg since it is a very nice debugger, then i decided to make something my own. I'll surely release the new versions of this disassembler, which i'll try to fix bugs or issues. You're welcome if you find something wrong on it or issues, feel free to contact me or in PM here or in this topic, I'm always glad to learn new things and try to do my best helping people. After said that, here there is a little description. Currently this disassembler supports: .NET executablesFunctions: Disassembler: There are 3 engines, (Distorm, Zydis, and Udis86). Opening an executable, you will be able to choose which engine you would like to use. Hex Dump: there are 3 types of them, the first one show only hex values, the second one too, and the third one can show the hex + ascii charcters. Memory Map: the memory map can show the PE structures(DosHeader, FileHeader, OptionalHeader). Protection Analyzer: Detect if the executable is packed and tell which packer is. AddressConverter + values calculator: As said the name, this feature has 2 options, can convert an adress (example from RVA to VA or vice versa), the values calculator can convert binary, hex, ascii values. Imports Table: Show the imports of a PE if detected. Exports Table: Show the Exports of a PE if detected. Relocations: Show the relocations of a PE if detected. Then there's the tools which allow you to add sections, import, relocation. It's possible to save The Memory map, Imports Table into a file. Download links: Project (Source Code): Build: , 23.29 MB Libraries used are:  | Сообщение посчитали полезным: hors |
|
|
Создано: 09 мая 2018 11:53 · Личное сообщение · #2 Do you have plan to make it cross-platform? You already use QT for interface, so it doesn't seem impossible ) ----- EnJoy! | Сообщение посчитали полезным: sefkrd |
|
|
Создано: 09 мая 2018 11:57 · Личное сообщение · #3 Sure, Maybe i'll do it in my future version.  ^
|
|
|
Создано: 09 мая 2018 12:10 · Личное сообщение · #4 Btw, about size: Name: Size: 138.81 MB File "KirbiDSMx64-OPS.exe" is less than 3 MB Why so huge? ----- EnJoy! |
|
|
Создано: 09 мая 2018 12:39 · Личное сообщение · #5 Because it include Qt dlls too, the exe is like 4mb or such |
|
|
Создано: 09 мая 2018 12:48 · Личное сообщение · #6 But it's 448 MB in unpacked state %D Are you sure that you need to redistribute all of these components? libEGL.dll
----- EnJoy! |
|
|
Создано: 09 мая 2018 12:51 · Поправил: Kirbiflint · Личное сообщение · #7 I just now re-builed it with another mode.. now it should works and the size its about 10mb https://www20.zippyshare.com/v/WFbOdgT5/file.html |
|
|
Создано: 09 мая 2018 14:16 · Личное сообщение · #8 Guys sorry for my mistake, but now i fixed it and tested with another PC.. Here the working buid.. i'll edit the topic too.. about the .NET decompiler just download it from the old build and put the folder in this one.. here link https://www89.zippyshare.com/v/TMmTAt6Z/file.html Sorry again |
|
|
Создано: 09 мая 2018 14:18 · Поправил: dosprog · Личное сообщение · #9 ) I'm sure again - If I can not download the file, then it really does not need me. Philosophy sefkrd writes: dosprog Perhaps this is your problem. ) No problems, really. |
|
|
Создано: 09 мая 2018 15:09 · Личное сообщение · #10 bad https://github.com/Kirbiflint50/KirbiDSMx64-OPS/blob/master/KirbiDSMx64-OPS/protectionanalyzer.cpp good https://github.com/VirusTotal/yara |
|
|
Создано: 09 мая 2018 15:41 · Личное сообщение · #11 dosprog Perhaps this is your problem. |
|
|
Создано: 09 мая 2018 16:02 · Личное сообщение · #12 Nice job! Keep going! ----- http://ntinfo.biz |
|
|
Создано: 09 мая 2018 20:49 · Личное сообщение · #13 Jupiter writes: You already use QT for interface, so it doesn't seem impossible ) after debugger Mr., I can not say anything good about the environment Qt. dnSpy on c#, is much more reliable. ----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 09 мая 2018 21:50 · Личное сообщение · #14 Bronco qt equals shit? 
----- EnJoy! |
|
|
Создано: 09 мая 2018 22:04 · Личное сообщение · #15 Jupiter I can not say anything good about the environment Qt == shit ??? do not you think that this is a polar statement? at hors sniffer the same often does not answer immediately, on large files. and I do not understand why, cross platform for files under Windows? ----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 09 мая 2018 22:14 · Личное сообщение · #16 Bronco Detect It Easy / DiE is very handy tool that I use on mac, but hors doesn't fix very annoying bug with drag-n-drop. Anyway even his xvolkolak is able to unpack windows files on mac! ----- EnJoy! |
|
|
Создано: 09 мая 2018 22:36 · Поправил: Bronco · Личное сообщение · #17 Jupiter writes: to unpack windows files on mac! I do not return that the category of cross-platform code is a high standard. but you still have not explained to me why you need files from the Windows environment, in a Mac environment? such ne format, this is the specifics of windows, and, for these problems Qt on large volumes, a bad solution. ----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 09 мая 2018 23:11 · Личное сообщение · #18 Bronco writes: why you need files from the Windows environment, in a Mac environment What's the point? I research different things from different platforms. It's OK in real world )) Easy, easy, real talk ) ----- EnJoy! |
|
|
Создано: 10 мая 2018 20:53 · Поправил: Bronco · Личное сообщение · #19 Kirbiflint first acquaintance with the engine distorm, and ... Code:
in the engine there is an api for decode the pointer (rip+disp)? I did not find where the detailed description mode to highlight this type of instruction ----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 10 мая 2018 21:46 · Личное сообщение · #20 I think there's not a function that can do that in Distorm, By the way, have you tried the other engines if they works about that? |
|
|
Создано: 10 мая 2018 22:12 · Личное сообщение · #21 Kirbiflint writes: if they works about that? , the last update was 3-5 years ago, I do not see the idea of it watching Zydis - is the best of your list of engines, leave only him. 
----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 11 мая 2018 00:53 · Поправил: bizkitlimp · Личное сообщение · #22 Bronco writes: -->Udis86 <--, the last update was 3-5 years ago, I do not see the idea of it watching There wouldn't be a point if only whole cpu world had changed (currently nothing has changed), or if brand new instruction sets released lately. Are there indeed brand new stuff and udis86 requires an update now? Cuz I'm using it, but i don't mind moving to something else. |
|
|
Создано: 11 мая 2018 05:50 · Личное сообщение · #23 bizkitlimp writes: (currently nothing has changed) I did not check the capabilities of this engine. in the visual studio 2015, the project is not going.  from the description on the page: Code:
there are gaming applications x64, where there are instructions from the set of AVX, and others
----- Чтобы юзер в нэте не делал,его всё равно жалко.. |
|
|
Создано: 11 мая 2018 11:27 · Личное сообщение · #24 what about AVX512 as well as ZMM registers support? almost 0 tools nowadays that do that, unfortunately |
|
eXeL@B —› WorldWide —› KirbiDSMx64-OPS (Open Source 64 bit Disassembler) |
Для печати