reversing a PE file into it's obj's?
reversing a PE file into it's obj's?
Is it possible to go the other way.
PE .exe ---> linker (or some program to reverse engineer ) ----> obj's that where used to create the PE .exe.
I would think this is not possible.
Unless their was a symbol table in the PE that held the names and address of the function's and the obj files they where linked from?
I am just curious if it is possible and if so how it is done?
I am really think it is a one way thing
obj's -->linker -->PE .exe .
But you can always disassembly the sections. So you always have the code,data,...etc but I am wondering if you can put them back into their obj's. Like given a random .exe file can you send it to a program that gives you back the obj files that where used to link to that .exe file.
Also is their away with VS 2005 to have your c/c++ code assembly to assembly source code. Then customize it and compile with masm to your PE or bin or whatever.... ?
Same question but with gcc/ld ? Can you compile your c/c++ code to asm source instead of compiling to machine code automatically.
Thanks for any input.
PE .exe ---> linker (or some program to reverse engineer ) ----> obj's that where used to create the PE .exe.
I would think this is not possible.
Unless their was a symbol table in the PE that held the names and address of the function's and the obj files they where linked from?
I am just curious if it is possible and if so how it is done?
I am really think it is a one way thing
obj's -->linker -->PE .exe .
But you can always disassembly the sections. So you always have the code,data,...etc but I am wondering if you can put them back into their obj's. Like given a random .exe file can you send it to a program that gives you back the obj files that where used to link to that .exe file.
Also is their away with VS 2005 to have your c/c++ code assembly to assembly source code. Then customize it and compile with masm to your PE or bin or whatever.... ?
Same question but with gcc/ld ? Can you compile your c/c++ code to asm source instead of compiling to machine code automatically.
Thanks for any input.
Re: reversing a PE file into it's obj's?
Why would you want that? Theoretically it's possible - disassemble the executable file and separate each function. However I fail to see the practical use of it.Sam111 wrote: Is it possible to go the other way.
What you are looking for is a "compile only, don't link" option. In the case of msvc, there is a way to have msvc output assembly source. Go to project properties -> C/C++ compiler -> output files -> assembler output and specify what you want. I usually use "Assembly, Machine and Source Code (/FAcs)" settings. The resulting assembler source is not compatible with any assembler though, however it should be possible to convert it to what format masm accepts.Sam111 wrote: Also is their away with VS 2005 to have your c/c++ code assembly to assembly source code. Then customize it and compile with masm to your PE or bin or whatever.... ?
I'm sure there is a similar option. If I remember correctly it is /c /s or something.Sam111 wrote: Same question but with gcc/ld ? Can you compile your c/c++ code to asm source instead of compiling to machine code automatically.
Re: reversing a PE file into it's obj's?
Because I am just curious if it is a one way process?Why would you want that? Theoretically it's possible - disassemble the executable file and separate each function. However I fail to see the practical use of it.
Ya, but then how do you know what functions go into what obj's and what the names of the linked obj's where?
Sure you can disassembly every function but how do you know where they go !
I would think the only way is by a symbol table but that doesn't have to be in the PE.
So even if I compile to assembly source. I couldn't take the asm and compile to a PE or Bin using masm?What you are looking for is a "compile only, don't link" option. In the case of msvc, there is a way to have msvc output assembly source. Go to project properties -> C/C++ compiler -> output files -> assembler output and specify what you want. I usually use "Assembly, Machine and Source Code (/FAcs)" settings. The resulting assembler source is not compatible with any assembler though, however it should be possible to convert it to what format masm accepts.
I would think masm could handle VS2005 asm source without having to modify the source?
Anyway I am wondering what I would have to changed in the asm source to get masm to compile it.
Re: reversing a PE file into it's obj's?
If the information isn't there, you can't get it. You can only extract symbol names and values if there's a symbol table.Sam111 wrote:I would think the only way is by a symbol table but that doesn't have to be in the PE.
Cheers,
Adam
Re: reversing a PE file into it's obj's?
I am just curious on what the percentage's of exe that have enough info to reverse engineer it to obj's.
I.E how many exe have symbol tables in them. 1 out of 10 , 1 out 100 ,... approximately.
Anybody know how common it is for an exe to have a symbol table.
But in any case if it doesn't have a symbol table you cann't go back to the obj's. I got you on that. That is what I was suspecting though I wanted to be 100% sure.
Their is no other way you can get the obj file names and their functions from the linked .exe file?
Also is their away to tell gcc/ld to produce intel asm source I have been getting AT&T Syntax source code. And prefer use intel syntax never really did to much with AT&T syntax. But if their is noway I guess it will be ok.
I.E how many exe have symbol tables in them. 1 out of 10 , 1 out 100 ,... approximately.
Anybody know how common it is for an exe to have a symbol table.
But in any case if it doesn't have a symbol table you cann't go back to the obj's. I got you on that. That is what I was suspecting though I wanted to be 100% sure.
Their is no other way you can get the obj file names and their functions from the linked .exe file?
Also is their away to tell gcc/ld to produce intel asm source I have been getting AT&T Syntax source code. And prefer use intel syntax never really did to much with AT&T syntax. But if their is noway I guess it will be ok.
Last edited by Sam111 on Mon Feb 02, 2009 1:43 pm, edited 1 time in total.
Re: reversing a PE file into it's obj's?
Hi,
Cheers,
Adam
I don't know how you would make an accurate guess, but as far as I'm concerned, a debug compile produces an executable with symbols and a release compile produces an executable without symbols - except those required for dynamic linking.Sam111 wrote:I am just curious on what the percentage's of exe that have enough info to reverse engineer it to obj's.
Are you clairvoyant?But in any case if it doesn't have a symbol table you cann't go back to the obj's. I got you on that. That is what I was suspecting though I wanted to be 100% sure.
...
Their is no other way you can get the obj file names and their functions from the linked .exe file?
Cheers,
Adam
Re: reversing a PE file into it's obj's?
Also is their away to tell gcc/ld to produce intel asm source I have been getting AT&T Syntax source code. And prefer use intel syntax never really did to much with AT&T syntax. But if their is noway I guess it will be ok.
-
- Member
- Posts: 524
- Joined: Sun Nov 09, 2008 2:55 am
- Location: Pennsylvania, USA
Re: reversing a PE file into it's obj's?
What do you mean by 'produce'? They both produce regular machine code, which isn't Intel or AT&T syntax, its just binary. If you want to use intel syntax in inline assembly for gcc, just google for it.
Re: reversing a PE file into it's obj's?
All (*all*) PE executables had their symbols stripped that I came across. Maybe a few ones compiled on Cygwin had some sort of obscure symbol-table-looking-thingy. The current MS recommendation is that debug information should be in a Program Database (PDB) file separately, and linkers follow suit. This information can be queried by the PDB API, as far as I know.Sam111 wrote:I am just curious on what the percentage's of exe that have enough info to reverse engineer it to obj's.
I.E how many exe have symbol tables in them. 1 out of 10 , 1 out 100 ,... approximately.
Anybody know how common it is for an exe to have a symbol table.
If the information is not there, you can't get it. But you can guess it - give the object files random names (like Function<hash of code>.obj). But why does the name of the object file matter? More than that, why would you want to extract object files from an executable?Sam111 wrote: Their is no other way you can get the obj file names and their functions from the linked .exe file?
Re: reversing a PE file into it's obj's?
Ya, I see you really cann't reverse PE into obj's but again why would you want to. I agree their is no need to every have to reverse engineer to obj's.
Except for the possibility of being able to relink the obj's and add a few of your own obj's with an entry point to your code... Kind of like an exe binder. But I guess you could just throw all the functions into one obj and then use ld with that obj and your added obj files ...etc
I was wondering if you could get gcc to produce the asm source in intel syntax.
Except for the possibility of being able to relink the obj's and add a few of your own obj's with an entry point to your code... Kind of like an exe binder. But I guess you could just throw all the functions into one obj and then use ld with that obj and your added obj files ...etc
I meant when you compile with gcc noassemble you get the asm source in at&t syntax.What do you mean by 'produce'? They both produce regular machine code, which isn't Intel or AT&T syntax, its just binary. If you want to use intel syntax in inline assembly for gcc, just google for it.
I was wondering if you could get gcc to produce the asm source in intel syntax.
-
- Member
- Posts: 524
- Joined: Sun Nov 09, 2008 2:55 am
- Location: Pennsylvania, USA
Re: reversing a PE file into it's obj's?
The-masm option (ie -masm=intel) does this. Note that this doesn't work on some platforms.
Re: reversing a PE file into it's obj's?
afaik, you cant separate a PE into each of its individual source objs, but with a disassembler you can disassemble the source into a single ASM source which you could then extend, although the symbol labels would likely be randomly generated. As for compiling C/++ source to assembly, simply add the -c switch to the command line. For turning AT&T into intel syntax, as far as i know youll have to do that yourself, although there may be tools/switches to do it for you.
Re: reversing a PE file into it's obj's?
mrnoob wrote:As for compiling C/++ source to assembly, simply add the -c switch to the command line.
- -E to preprocess without compilation (output is source with comments removed and includes included),
- -S to compile without assemblation (output is assembler source, but see (*) below),
- -o to compile and assemble without linking (output is object file).
For turning AT&T into intel syntax, as far as i know youll have to do that yourself, although there may be tools/switches to do it for you.
- gcc -masm=att -S test.c # gives AT&T disassembly
- gcc -masm=intel -S test.c # gives Intel disassembly
Every good solution is obvious once you've found it.
Re: reversing a PE file into it's obj's?
Ok , got it.
One more related question I have
Is the obj file format in coff or xcoff or PE/coff.
Like .o files are probably in a different format then microsoft obj extension. Would it be possible to take .obj's and link them with .o files?
I know the .exe , .dll , lib are in PE file format but if obj's are in this format as well then they must contain enough info for the linker to combined into one exe file. Does all the linker need to know is the sections or is their a symbol table for each obj file and it get's not included when in the exe by the linker.
For example
say I have obj1.o obj2.o
obj1 has only 2 functions and nothing else in it (i.e func1 , func2.)
obj2 has only 1 function and nothing else in it (i.e main )
Does the linker put in the
.text section
func1
func2
main ( and the entryaddresspointer gets set to this )
Or is their an order to merging the .data , text ,..etc section's.
What would be the steps that the linker goes thru to produce an exe file?
I am guessing it can add the machine code for the functions in any order to the .text section but it must just keep track of where the rva for the functions are and where the entry point address is. Then it resolves any unresolved or external symbols.
For any external symbol or unresolved symbol in an o file is their a special way to mark a symbol so that you know the difference between a resolved and unresolved symbol. Or does it just make an entry of all the symbols in the o file in some .rdata section and the linker can move the functions around by using the .rdata section.
One more related question I have
Is the obj file format in coff or xcoff or PE/coff.
Like .o files are probably in a different format then microsoft obj extension. Would it be possible to take .obj's and link them with .o files?
I know the .exe , .dll , lib are in PE file format but if obj's are in this format as well then they must contain enough info for the linker to combined into one exe file. Does all the linker need to know is the sections or is their a symbol table for each obj file and it get's not included when in the exe by the linker.
For example
say I have obj1.o obj2.o
obj1 has only 2 functions and nothing else in it (i.e func1 , func2.)
obj2 has only 1 function and nothing else in it (i.e main )
Does the linker put in the
.text section
func1
func2
main ( and the entryaddresspointer gets set to this )
Or is their an order to merging the .data , text ,..etc section's.
What would be the steps that the linker goes thru to produce an exe file?
I am guessing it can add the machine code for the functions in any order to the .text section but it must just keep track of where the rva for the functions are and where the entry point address is. Then it resolves any unresolved or external symbols.
For any external symbol or unresolved symbol in an o file is their a special way to mark a symbol so that you know the difference between a resolved and unresolved symbol. Or does it just make an entry of all the symbols in the o file in some .rdata section and the linker can move the functions around by using the .rdata section.
Re: reversing a PE file into it's obj's?
Almost all object files you encounter while working on Windows will be in the COFF format (including .o files produced by gcc under Cygwin). So it should be possible to link them together (C++ name mangling is another issue). Object files produced by gcc under *nix may also be usable if gcc produces COFF object files.Sam111 wrote:One more related question I have
Is the obj file format in coff or xcoff or PE/coff.
Like .o files are probably in a different format then microsoft obj extension. Would it be possible to take .obj's and link them with .o files?
Library (lib) files are not PE files, they are like a special archive file that contains multiple object files (also called archive members). Object files contains symbol tables. PE executable files may contain symbol table, however all linkers seem to remove the symbol table from the executable (and place the debugging information into a separate PDB file).Sam111 wrote: I know the .exe , .dll , lib are in PE file format but if obj's are in this format as well then they must contain enough info for the linker to combined into one exe file. Does all the linker need to know is the sections or is their a symbol table for each obj file and it get's not included when in the exe by the linker.
A linker is free to arrange the object files within a given section. So if you have three object files which contain .text sections, the ordering of the object files is up to the linker.Sam111 wrote: Or is their an order to merging the .data , text ,..etc section's.
I believe I have answered this question previously.Sam111 wrote: What would be the steps that the linker goes thru to produce an exe file?