If you're working with Windows files and have Visual Studio, you can use the dumpbin tool.
dumpbin /disasm ntoskrnl.exe /out:ntoskrnl.asm
It won't display exports inline either, but you can see them separately with the /exports switch. Then you can make a little script to parse the exports and replace the addresses in the assembly listing with names.
Display the assembler mnemonics for the machine instructions from objfile. This option only disassembles those sections which are expected to contain instructions.
-D
--disassemble-all
Like -d, but disassemble the contents of all sections, not just those expected to contain instructions. If the target is an ARM architecture this switch also has the effect of forcing the disassembler to decode pieces of data found in code sections as if they were instructions.
It will already be installed on most Linux distributions that have GCC or other development tools installed, and Windows versions are available via e.g. Cygwin.
You can examine imports, exports, debug symbols (if you have .pdb file), flip code to data, data to code (look at keyboards shortcuts in readme.pdf) has support for bookmarks, adding comments also you can save the database to work on it later...
发布评论
评论（6）
我使用 objdump -d 。 :-) 这对你不起作用吗？
I use
objdump -d. :-) Does that not work for you?如果您正在使用 Windows 文件并拥有 Visual Studio，则可以使用 dumpbin 工具。
它也不会内联显示导出，但您可以使用 /exports 开关单独查看它们。然后，您可以编写一个小脚本来解析导出并将程序集列表中的地址替换为名称。
If you're working with Windows files and have Visual Studio, you can use the dumpbin tool.
It won't display exports inline either, but you can see them separately with the /exports switch. Then you can make a little script to parse the exports and replace the addresses in the assembly listing with names.
GNU binutils 有
objdump、哪个应该有效：它已经安装在大多数安装了 GCC 或其他开发工具的 Linux 发行版上，Windows 版本可以通过例如 Cygwin 获得。
GNU binutils has
objdump, which should work:It will already be installed on most Linux distributions that have GCC or other development tools installed, and Windows versions are available via e.g. Cygwin.
ArkDasm 是一个 64 位交互式反汇编程序。支持的文件类型：PE64、原始二进制文件。
http://www.arkdasm.com/
您可以检查导入、导出、调试符号（如果您有.pdb 文件），将代码翻转为数据，将数据翻转为代码（查看 readme.pdf 中的键盘快捷键）支持书签，添加注释，您还可以保存数据库以便稍后处理...
ArkDasm is a 64-bit interactive disassembler. Supported file types: PE64, raw binary files.
http://www.arkdasm.com/
You can examine imports, exports, debug symbols (if you have .pdb file), flip code to data, data to code (look at keyboards shortcuts in readme.pdf) has support for bookmarks, adding comments also you can save the database to work on it later...
http://www.duxcore.com/products.html
http://www.duxcore.com/fs_files/VisualDuxDbgSetup.zip
Visual DuxDebugger是适用于 Windows 的 64 位调试器反汇编程序。
主要特点
完全支持64位本机进程
完全支持 64 位 .NET 进程
完整代码分析
全内存分析
代码版
记忆版
模块导出格式（EXE/DLL/CSV）
调试多个进程
调试多个子进程的
最低要求
操作系统：Windows 7 64位/Windows Server 2008 R2
处理器：Pentium 4 3.0 GHz
推荐要求
操作系统：Windows 7 64位/Windows Server 2008 R2
处理器：双核 2.5 GHz
显示：1920 x 1080
http://www.duxcore.com/products.html
http://www.duxcore.com/fs_files/VisualDuxDbgSetup.zip
Visual DuxDebugger is a 64-bit debugger disassembler for Windows.
Main features
Fully support 64-bit native processes
Fully support 64-bit .NET processes
Full code analysis
Full memory analysis
Code edition
Memory edition
Module export formats (EXE/DLL/CSV)
Debug multiple processes
Debug multiple child processes
Minimum Requirements
O.S: Windows 7 64-bit / Windows Server 2008 R2
Processor: Pentium 4 3.0 GHz
Recommended Requirements
O.S: Windows 7 64-bit / Windows Server 2008 R2
Processor: Dual Core 2.5 GHz
Display: 1920 x 1080
WinDbg 将转储导出表并让您查看
WinDbg will dump the export table and let you poke around