using X86Disassembler.PE; using X86Disassembler.X86; namespace X86Disassembler; /// /// Main program class /// public class Program { // Hardcoded file path for testing private const string FilePath = @"C:\Program Files (x86)\Nikita\Iron Strategy\Terrain.dll"; /// /// Main entry point /// /// Command line arguments public static void Main(string[] args) { Console.WriteLine("X86 Disassembler and Decompiler"); Console.WriteLine("--------------------------------"); // Load the file Console.WriteLine($"Loading file: {FilePath}"); byte[] fileBytes = File.ReadAllBytes(FilePath); Console.WriteLine($"Successfully loaded {FilePath}"); Console.WriteLine($"File size: {fileBytes.Length} bytes\n"); // Parse the PE format Console.WriteLine("Parsing PE format...\n"); PeFile peFile = new PeFile(fileBytes); peFile.Parse(); // Print PE file information Console.WriteLine("PE File Information:"); Console.WriteLine($"Architecture: {(peFile.OptionalHeader.Is64Bit() ? "64-bit" : "32-bit")}"); Console.WriteLine($"Entry Point: 0x{peFile.OptionalHeader.AddressOfEntryPoint:X8}"); Console.WriteLine($"Image Base: 0x{peFile.OptionalHeader.ImageBase:X8}"); Console.WriteLine($"Number of Sections: {peFile.FileHeader.NumberOfSections}"); Console.WriteLine(); // Print section information PrintPeSections(peFile); // Print export information PrintPeExports(peFile); // Print import information PrintPeImports(peFile); // Find code sections var codeSections = peFile.SectionHeaders.FindAll(s => s.ContainsCode()); Console.WriteLine($"Found {codeSections.Count} code section(s):"); foreach (var section in codeSections) { Console.WriteLine($" - {section.Name}: Size={section.VirtualSize} bytes, RVA=0x{section.VirtualAddress:X8}"); } Console.WriteLine(); // Disassemble the first code section if (codeSections.Count > 0) { var section = codeSections[0]; byte[] codeBytes = peFile.GetSectionData(peFile.SectionHeaders.IndexOf(section)); // First demonstrate sequential disassembly Console.WriteLine($"Sequential disassembly of section {section.Name} at RVA 0x{section.VirtualAddress:X8}:"); // Create a disassembler for the code section // Base address should be the section's virtual address, not the image base + VA Disassembler disassembler = new Disassembler(codeBytes, section.VirtualAddress); // Disassemble sequentially (linear approach) var linearInstructions = disassembler.Disassemble(); // Print the first 30 instructions from linear disassembly int linearCount = Math.Min(30, linearInstructions.Count); for (int i = 0; i < linearCount; i++) { Console.WriteLine(linearInstructions[i]); } // Print a summary of how many more instructions there are if (linearInstructions.Count > linearCount) { Console.WriteLine($"... ({linearInstructions.Count - linearCount} more instructions not shown)"); } Console.WriteLine(); Console.WriteLine("===================================================="); Console.WriteLine(); // Now demonstrate control flow-based disassembly from entry point Console.WriteLine($"Control flow-based disassembly starting from entry point 0x{peFile.OptionalHeader.AddressOfEntryPoint:X8}:"); try { // Get the entry point RVA from the PE header uint entryPointRva = peFile.OptionalHeader.AddressOfEntryPoint; // Make sure the entry point is within this code section if (entryPointRva >= section.VirtualAddress && entryPointRva < section.VirtualAddress + section.VirtualSize) { // Disassemble starting from the entry point (control flow-based) var cfgInstructions = disassembler.DisassembleFunction(entryPointRva); // Print the instructions from the entry point function int cfgCount = Math.Min(50, cfgInstructions.Count); for (int i = 0; i < cfgCount; i++) { Console.WriteLine(cfgInstructions[i]); } // Print a summary if there are more instructions if (cfgInstructions.Count > cfgCount) { Console.WriteLine($"... ({cfgInstructions.Count - cfgCount} more instructions in this function not shown)"); } Console.WriteLine(); Console.WriteLine($"Found {cfgInstructions.Count} instructions following control flow from entry point."); } else { // Try one of the exported functions instead Console.WriteLine($"Entry point is not in the {section.Name} section. Trying the first exported function instead..."); if (peFile.ExportDirectory != null && peFile.ExportedFunctions.Count > 0) { uint functionRva = peFile.ExportedFunctions[0].AddressRva; Console.WriteLine($"Disassembling exported function at RVA 0x{functionRva:X8} ({peFile.ExportedFunctions[0].Name}):"); var cfgInstructions = disassembler.DisassembleFunction(functionRva); // Print the instructions from the function int cfgCount = Math.Min(50, cfgInstructions.Count); for (int i = 0; i < cfgCount; i++) { Console.WriteLine(cfgInstructions[i]); } // Print a summary if there are more instructions if (cfgInstructions.Count > cfgCount) { Console.WriteLine($"... ({cfgInstructions.Count - cfgCount} more instructions in this function not shown)"); } Console.WriteLine(); Console.WriteLine($"Found {cfgInstructions.Count} instructions following control flow from exported function."); } else { Console.WriteLine("No exported functions found to disassemble."); } } } catch (Exception ex) { Console.WriteLine($"Error during control flow disassembly: {ex.Message}"); } } // Console.WriteLine("\nPress Enter to exit..."); // Console.ReadLine(); } private static void PrintPeImports(PeFile peFile) { Console.WriteLine("Imported Functions:"); Console.WriteLine($"Number of Imported DLLs: {peFile.ImportDescriptors.Count}"); foreach (var import in peFile.ImportDescriptors) { Console.WriteLine($" DLL: {import.DllName}"); for (int i = 0; i < import.Functions.Count; i++) { var function = import.Functions[i]; if (function.IsOrdinal) { Console.WriteLine($" {i}: Ordinal {function.Ordinal}"); } else { Console.WriteLine($" {i}: {function.Name} (Hint={function.Hint})"); } } } Console.WriteLine(); } private static void PrintPeExports(PeFile peFile) { Console.WriteLine("Exported Functions:"); Console.WriteLine($"DLL Name: {peFile.ExportDirectory.DllName}"); Console.WriteLine($"Number of Functions: {peFile.ExportDirectory.NumberOfFunctions}"); Console.WriteLine($"Number of Names: {peFile.ExportDirectory.NumberOfNames}"); for (int i = 0; i < peFile.ExportedFunctions.Count; i++) { var export = peFile.ExportedFunctions[i]; Console.WriteLine($" {i}: {export.Name} (Ordinal={export.Ordinal}, RVA=0x{export.AddressRva:X8})"); } Console.WriteLine(); } private static void PrintPeSections(PeFile peFile) { Console.WriteLine("Sections:"); foreach (var section in peFile.SectionHeaders) { string flags = ""; if (section.ContainsCode()) flags += "Code "; if (section.IsExecutable()) flags += "Exec "; if (section.IsReadable()) flags += "Read "; if (section.IsWritable()) flags += "Write"; Console.WriteLine($" {peFile.SectionHeaders.IndexOf(section)}: {section.Name,-8} VA=0x{section.VirtualAddress:X8} Size={section.VirtualSize,-8} [{flags}]"); } Console.WriteLine(); } }