• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Disassembler for use on Win32 Executables needed

Schadenfroh

Elite Member
It would be greatly appreciated if someone knew of a good disassembler to use on Windows 32-bit Executables. I require knowing the order of system calls in an executable, specifically for the purpose of determining the potential maliciousness of the executable.

I have tried Win32 Program disassembler, but I have noticed anomalies in the disassembly (like jumps to addresses that do not exist, issues that were discovered while writing a program to trace the assembly code's possible paths during execution).
I have also tried BinUtil's objdump, but I am unable to ascertain the system calls from the disassembly that it produces (no calls match the address where the system calls are located) with Win32 executables (unless I am using the incorrect arguments).

What I need in a disassembler:
  • Able to be automated (going to disassemble hundreds of executables) to write the results to a text file
  • Able to identify where the system calls take place (objective)
  • Freeware for educational institutions / purposes

Any ideas?

Thanks in advance!
 
I require knowing the order of system calls in an executable, specifically for the purpose of determining the potential maliciousness of the executable.

What if the calls are made with dynamically-generated code? You'd miss them...
 
Back
Top