Home PageModifyTime 2006-10-04



perdr [options] <executable>
Options are similar to Posix semantic

--end option (useful if filename start with -)
--helpprint help screen
-v, --versionprint version
-b, --bytesshow bytes on disassembly
-p, --show-priorityshow disassembler priority
--raw-dumpdon't disassemble, print only raw bytes
--extract-icon-resourceextract icon into separate files (resicoX.ico)
--no-entry-codedo not assume entry point points to code
--disable-3dnowdisable 3DNow! disassembly (even enhanced)
--disable-enh3dnowdisable enhanced 3DNow! disassembly
--disable-pentium3disable Pentium III disassembly
--disable-athlondisable Athlon disassembly
-h, --show-headersshow short headers
-H, --full-headersshow full headers
-i, --show-importsshow imports
--show-relocationsshow relocations
-e, --show-exportsshow exports
-r, --show-resourcesshow resources
-R, --raw-resourcesshow resources in raw format
-c, --show-codeshow code or dump
--show-crefshow call references
--show-Urefshow unconditional jump references
--show-Crefshow conditional jump references
--show-refsshow all references

This reverse the executable to screen


"secure code":
 entry pointcode executed by entry point
 safe exportcode executed by known export (not yet implemented)
 safe heuristicscode executed by heuristics (very sure code)
"not secure":
 exportcode executed by export (mm.. not all export are code)
 heuristicscode executed by heuristics (not very sure, like a single call found)
 constantonly a constant in code
 filleronly printed for completion
 nonethis is not code
 check onlywow! If you find there is a bug

Work to do

- This program assume that code segment contain only code
- More check

- Data analysis completing
- String checking completing
- More option (no code analysis, some check skipping, etc)
- Resource analysis and dumping
- Relocation analysis and test on data pointers
- Heuristic motor completing
- Some instruction process are incomplete (complex reference)
- Unknown bytes analysis (not only code)
- Print of some type (float or MMX). Now only in raw mode (binary)

Home Page
SourceForge Logo
Valid CSS! Valid HTML 4.01! WML, Website META Language