.NET Disassemblers

Subject: .NET Disassemblers Fri Jan 31, 2014 11:00 pm

Quote :: IDA Pro

Quote :: The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows or on Linux. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.
There is also a free (crippled) version available (IDA Pro Free). See its own entry in the library for more info.
As of January 7, 2007, the official IDA Pro website moved from the old URL (http://www.datarescue.com/idabase) to the one listed above.
Download

Quote :: radare

Quote :: The radare project aims to provide a complete unix-like toolchain for working with binary files. It currently provides a set of tools to work with x86, x86_64, mips, arm, sparc, csr, m68k, powerpc, dalvik and java.
The core is a raw hexadecimal editor for commandline with scripting features and perl/python extensions that gets extended with IO plugins that hooks the open/read/write/close/system calls.
The debugger and disassembler has a code analysis module for various architectures. The disassembler has been enhaced to handle inline comments, code block detections and flag references (data pointers or so) and much more.
Download

Quote :: DisasMSIL

Quote :: DisasMSIL is a free/open disasm engine for the Microsoft Intermediate Language (MSIL). You can use it any context you wish. There are no license restrictions. The only thing I ask you to do is to send me your bug fixes (if any).

Note: Don't rely on the ECMA specification (Partition III: Common Language Infrastructure), since it's incomplete. Some new opcodes were introduced with the .NET Framework 2.0.
Download

Quote :: Dot Net String Decoder

Quote :: Program can list or decrypt strings used in .NET executable based on user decryption plugins and rebuild new assembly with decoded strings. Method names, control flow etc. are unchanged in assembly!

Features:
- List all strings that are used in .NET executable
- Generic search for decoding function like: DecodeFunction(Byval Coded_String as String) As String
- Decrypt strings based on your own plugin
- Very simple plugin interface (C#, VB.NET)
- Preview of string decryption (checking results)
- Rebuild application with decoded strings (removing decoding function)
- Explorer with all methods for fast navigation
- Export method tree to text file
- Fast string extraction
- Very good and easy searching
- Export strings to text file for further processing
- DisAssemble selected method
- Instruction coloring for fast navigation (Strings, Numbers, Calls, Jumps)
- See real file offset and opcode bytes
- Jump from opcode to file with hexeditor (patching)
Download

Quote :: DotFu ckScator v1.3

Quote :: ....V1.3

... is a reversing engineering tool used to remove string encryption
from dotfuscator protected files

If the original file was strong name signed ... will create a new keypair
and re-sign the file with this pair, be carefull since file depending on this file will
need to be edited manualy to support the new strong name signature.
You can use RE-Sign for this and the editor of your choice

Also if you like the file re-signed with a specific key place your key in the same
folder as the file you are about to process and rename it to ....snk
now ... will use this key for the re-sign process.
Hope this tool is of any use
Changes:
* v1.1 has a minor bugfix that prevented some strings from proper decrypting
* v1.2 small bugfix in re-signing, added indicator to show the amount of
strings decrypted so far
* v1.3 Fixed royal f.u.c.k.-up in string decryption code replacement function
meaning the output will now run after string decryption removal
Download

Quote :: PEBrowse Professional

Quote :: PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others. (We have received reports that the software also works on other OSes, including Wine (!) and Windows CE.)
With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse. The information is organized in a convenient treeview index with the major divisions of the PE file displayed as nodes. In most cases selecting nodes will enable context-sensitive multiple view menu options, including binary dump, section detail, disassembly and structure options as well as displaying sub-items, such as optional header directory entries or exported functions, that can be found as part of a PE file unit. Several table displays, hex/ASCII equivalents, window messages and error codes, as well as a calculator and scratchpads are accessible from the main menu.
While the binary dump display offers various display options, e.g., BYTE, WORD, or DWORD alignment, the greatest value of PEBrowse comes when one disassembles an entry-point. An entry-point in PEBrowse is defined as:
* Module entry-point
* Exports (if any)
* Debug-symbols (if a valid PDB, i.e., program database file, is present)
* Imported API references
* Relocation addresses
* Internal functions/subroutines
* Any valid address inside of the module
Selecting and disassembling any number of these entry-points produces a versatile display rich in detail including upper/lowercase display, C/Pascal/Assembler suffix/prefixing, object code, color-coded statements, register usage highlighting, and jump/call target preview popups. Additional information, such as variable and function names, will also be present if one has access to a valid PDB file. Disassembly comes in two flavors: linear sweep (sequential disassembly from a starting address) and recursive traversal, aka, analysis mode (disassembly of all statements reachable by non-call statements - extended analysis disassembles all internal call statements as well). The latter mode also presents local variables with cross-referencing, highlighting, and renaming options. If one adds/changes variable name or adds comments to specific lines, these can be displayed in a session file which will record and save all currently opened displays.
PEBrowse Professional will decompile type library information either embedded inside of the binary as the resource "TYPELIB" or inside of individual type libraries, i.e., .TLB or .OLB files.
PEBrowse Professional also displays all metadata for .NET assemblies and displays IL (Intermediate Language) for .NET methods. It seamlessly handles mixed assemblies, i.e., those that contain both native and managed code.
Finally, PEBrowse can be employed as a file browse utility for any type of file with the restriction that the file must be small enough that it can be memory-mapped.
Download

Quote :: Please dont spam . reply another Disassemblers only