unPIC - The PIC disassembler

(by T.Rudnai - 12/09/2008)

unPIC is a Perl script that disassembles Microchip microcontroller's HEX files. This is a powerful tool for all reverse engeneers that creates a well understandable assembly source from a binary file. Creates xrefs, labels, subroutines and much more...



As I have spent my life with analyzing viruses and other malwares like spywares and adwares I have seen quite a few of disassembled codes. Many of these were written in Assembly but nowodays most of them written in high level language (HLL) like C, C++ or Pascal To understand what's going on is sometimes not as easy as it seems. This happenes basically because of how the human brain works. Human understands literatures better than numbers, that's why basically you need to translate the machine code back to assembly instructions. And then the brain just do not want to keep in mind what is stored in the memory area 0x5782... So that if not then it is better to rename that area to something more easy to remember, to a text label that can tell what is the meaning. For example a label like 'keyboard_state' would be better to understand the purpose of that area. The bad thing is that as we human could not understand numbers very well computers could not understand texts at all. So that a disassembler will not be able to tell what is that memory area for, so do not know what label has to be put on. So all it can do is to put a label something like: 'mem_5782', and later on the human could find out a better name for it.

Comments

#1 | cat2kill on October 02 2008 16:21:23
This is nice! Smile Useful too!
But is there any chance for something to convert ASM to C++, Pascal, Basic? That would be really nice!
#2 | trudnai on October 02 2008 18:42:17
Cheers man! Well, to reversing to a high level language is a real challenge as there is a need to recognise the compiler including the version of it. Then maybe with a database that contains all the language elements you can identify the structure. However, upon all of these the whole lot is much harder in the real world as the code optimization scrambles the binary a lot and encrypts the code making it virtually unrecognisable. Anyway, if you have ideas on it it is more than welcome and we can discuss about it on the forum area.
#3 | szilva on October 02 2008 19:09:46
In my opinion high level "dis-compile" is almost impossible. I see the main cause in optimizations which are always present partway.
#4 | chawsu on April 06 2009 21:35:34
Thank you very much. I got what I am searching for. I'll use it and discuss later.
#5 | dan4rave on April 09 2010 12:46:12
Thanks a lot
#6 | Pilgrim on May 27 2010 09:00:32
somehow i didn't manage to find much information about unPIC, just a couple of articles and this video in Italian http://www.videorolls.com/watch/Prototipo-per-dispensa-automatica-per-animali hope to learn more about this script with your help.
#7 | mike3050 on May 28 2010 18:55:11
thank,it's possible to convert it to C+?
Mike,auto insurance quotes
#8 | trudnai on June 23 2010 05:52:51
There are techniques that makes it possible, yes. For example if you know which C compiler was used, you can identify the code fragments of the standard libraries, prologue and epilogue of functions etc. unPIC does not support that.

Post Comment

Please Login to Post a Comment.

Ratings

Rating is available to Members only.

Please login or register to vote.

No Ratings have been Posted.
Render time: 0.03 seconds
545,192 unique visits