Disassembling

Goto the intel website and search around for the developers resources. You''ll find the programming references etc. (can''t remember exactly what the files are called and I don''t have links handy).

If you are trying to disassemble PE executables and not .com or .sys then you''ll need to find the PE specs too so you can extract the code sections. Disassemblers aren''t all that tricky to write, just takes some patience.

You need a list of the opcodes. Search for opcode references.

---

What does God want?
Does God want goodness or the choice of goodness?
Is a man who chooses the bad perhaps in some way better than a man who has the good imposed upon him?

It''s a matter of figuring out which parts of the program are data, and which are code. You leave the data alone, and then go through the code one byte at a time, mapping them to their corresponding instruction names. Of course most instructions are more than one byte but the idea is the same.

Watch out though, there may be some padding between instructions (to align them to a dword boundary perhaps) and there''s no easy way to track that, so if you assume 100% of the code segment contains valid code, then your disassembler will think the padding are opcodes, and it''ll usually throw off the rest of your output from that point on. I don''t know if compilers insert opcode 00 (NOP) for padding. Would help greatly if they do, but you can''t assume. Maybe they insert junk opcodes to thwart people like you... but don''t worry, you can do it

I suggest you start off easy, for example original Gameboy ROMS that run on a modified z80 CPU. The instruction set is fairly simple and no opcode is bigger than 3 bytes.

Good luck.

I would think first you are going to have to find a referance for the file format of the exe''s you want to examine. Under windows I think it is PE.