反汇编程序中特定地址处的 x86 代码
是否有任何 x86 反汇编器框架可用于分析程序中特定地址的代码，例如：
info = disassemble( startAddress , stopAddress)
它应该显示每条指令及其操作数以及任何其他有利于分析的信息，但它还应该具有快速模式获取每条指令的那么多信息并不重要，而只获取其中一些可以指定的信息。
Is there any x86 disassembler framework that can be used to analyze code from a specific address in a program, as in:
info = disassemble( startAddress , stopAddress)
It should show every instruction and its operands and any other info that is good for analysis but it should have also fast mode where it isn't so important to obtain that much info for each instruction, but only for some of them that can be specified.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
GNU binutils 还不够好吗？以下是使用 objdump 实用程序执行此操作的方法：
Is GNU binutils not good enough? Here's how to do that with the objdump utility:
Google 的 protobuf 使用 libdisasm 来解决这个问题。遗憾的是（从源代码来看）它仅支持 ia32 和 x86，并且主页声明“它是 x86 特定的，不会扩展以包含其他 CPU 架构”。但由于您没有提到其他拱门，因此这个库可能就足够了。
Google's protobuf uses libdisasm for that matter. Sad thing is that (judging from source code) it only supports ia32 and x86 and homepage states that "it is x86 specific and will not be expanded to include other CPU architectures". But since you didn't mention other archs, this library may be sufficient.
跨平台的InstructionAPI适合这个目的，它会分析代码并可以打印出反汇编代码或提供与机器无关的指令视图供您查询。 instructionsAPI 是一个共享库，您可以将代码链接到它。
http://www.paradyn.org/html/manuals.html
The cross-platform InstructionAPI suits this purpose, it will analyze the code and can print out the disassembly or provide a machine-independent view of the instructions for you to query. InstructionAPI is a shared library that you would link your code against.
http://www.paradyn.org/html/manuals.html
我将调试到起点并查看调试器的反汇编输出。更残酷的方法是全部反汇编，在反汇编文件中搜索函数名。 objconv 可以做到这一点，但处理非常大的文件时速度很慢。
I would debug to the start point and look at the disassembly output of the debugger. A more brutal method is to disassemble it all and search for the function name in the disassembly file. objconv can do this, but it is slow on very big files.
尝试 BeaEngine
Try BeaEngine