Exe/DLL/Hex/Bin/ELF/lib/dylib/ARM64/So/Out/Obj反汇编反编译工具1可直接上手的反编译/反汇编工具核心代码支持常见文件格式解析分为两部分1. 命令行解析工具基于Python跨平台2. 简易图形界面工具PyQt5和你之前的界面风格一致你可以直接复制使用。一、核心功能说明下面的代码可以实现.exe/.dll/.elf/.so等PE/ELF文件解析.bin/.hex/.obj原始二进制文件读取与反汇编支持x86/x64/ARM指令解析使用capstone引擎二、依赖安装pipinstallpefile capstone pyelftools PyQt5三、核心命令行解析工具Python1. 支持PE/ELF/Bin文件解析反汇编importsysimportpefilefromcapstoneimport*fromelftools.elf.elffileimportELFFiledefdisassemble_pe(file_path):解析PE文件(.exe/.dll)并反汇编代码段try:pepefile.PE(file_path)print(f[] 成功解析PE文件:{file_path})print(f 入口点: 0x{pe.OPTIONAL_HEADER.AddressOfEntryPoint:08X})forsectioninpe.sections:namesection.Name.decode().strip(\x00)ifnamein(.text,CODE):print(f\n[] 解析代码段:{name})codesection.get_data()basepe.OPTIONAL_HEADER.ImageBasesection.VirtualAddress mdCs(CS_ARCH_X86,CS_MODE_64ifpe.FILE_HEADER.Machine0x8664elseCS_MODE_32)foriinmd.disasm(code,base):print(f0x{i.address:08X}:{i.mnemonic:8}{i.op_str})returnTrueexceptExceptionase:print(f[-] PE解析失败:{e})returnFalsedefdisassemble_elf(file_path):解析ELF文件(.elf/.so)并反汇编try:withopen(file_path,rb)asf:elfELFFile(f)print(f[] 成功解析ELF文件:{file_path})print(f 架构:{elf.get_machine_arch()})forsectioninelf.iter_sections():ifsection.name.text:print(f\n[] 解析代码段: .text)codesection.data()basesection[sh_addr]modeCS_MODE_ARMifelf.get_machine_arch()ARMelseCS_MODE_32 mdCs(CS_ARCH_ARMifelf.get_machine_arch()ARMelseCS_ARCH_X86,mode)foriinmd.disasm(code,base):print(f0x{i.address:08X}:{i.mnemonic:8}{i.op_str})returnTrueexceptExceptionase:print(f[-] ELF解析失败:{e})returnFalsedefread_bin_hex(file_path):读取.bin/.hex文件并打印前256字节内容try:withopen(file_path,rb)asf:dataf.read(256)print(f[] 文件前256字节十六进制:)foriinrange(0,len(data),16):linedata[i:i16]hex_str .join(f{b:02X}forbinline)print(f{i:04X}:{hex_str})returnTrueexceptExceptionase:print(f[-] 读取文件失败:{e})returnFalseif__name____main__:iflen(sys.argv)!2:print(用法: python disassembler.py 文件路径)sys.exit()file_pathsys.argv[1]extfile_path.split(.)[-1].lower()ifextin(exe,dll):disassemble_pe(file_path)elifextin(elf,so):disassemble_elf(file_path)elifextin(bin,hex,obj,out):read_bin_hex(file_path)else:print([-] 不支持的文件格式)四、简易图形界面工具PyQt5和你之前的界面风格一致可直接运行importsysfromPyQt5.QtWidgetsimport(QApplication,QMainWindow,QWidget,QVBoxLayout,QHBoxLayout,QPushButton,QLineEdit,QTextEdit,QFileDialog)fromPyQt5.QtCoreimportQtfromdisassemblerimportdisassemble_pe,disassemble_elf,read_bin_hex# 引用上面的核心函数classDisassemblerGUI(QMainWindow):def__init__(self):super().__init__()self.setWindowTitle(简易反汇编/反编译工具)self.setGeometry(100,100,900,600)self.init_ui()definit_ui(self):central_widgetQWidget()self.setCentralWidget(central_widget)layoutQVBoxLayout(central_widget)# 顶部路径栏path_layoutQHBoxLayout()self.path_editQLineEdit()self.path_edit.setPlaceholderText(选择文件.exe/.dll/.elf/.bin等)browse_btnQPushButton(浏览文件)browse_btn.clicked.connect(self.browse_file)run_btnQPushButton(开始解析)run_btn.clicked.connect(self.run_disassemble)path_layout.addWidget(self.path_edit)path_layout.addWidget(browse_btn)path_layout.addWidget(run_btn)layout.addLayout(path_layout)# 结果显示区self.result_textQTextEdit()self.result_text.setReadOnly(True)layout.addWidget(self.result_text)defbrowse_file(self):file_path,_QFileDialog.getOpenFileName(self,选择文件,,可执行文件 (*.exe *.dll *.elf *.so *.dylib);; 二进制文件 (*.bin *.hex *.obj *.out);; 所有文件 (*))iffile_path:self.path_edit.setText(file_path)defrun_disassemble(self):file_pathself.path_edit.text().strip()ifnotfile_path:self.result_text.setText(请先选择文件)returnself.result_text.clear()self.result_text.append(f正在解析:{file_path})self.result_text.append(-*60)extfile_path.split(.)[-1].lower()importiofromcontextlibimportredirect_stdout fio.StringIO()withredirect_stdout(f):ifextin(exe,dll):disassemble_pe(file_path)elifextin(elf,so):disassemble_elf(file_path)else:read_bin_hex(file_path)self.result_text.append(f.getvalue())if__name____main__:appQApplication(sys.argv)windowDisassemblerGUI()window.show()sys.exit(app.exec_())五、工具扩展说明1. 支持的格式与架构文件类型支持架构功能.exe/.dllx86/x64PE文件解析 代码段反汇编.elf/.sox86/x64/ARMELF文件解析 代码段反汇编.bin/.hex/.obj/.out任意原始二进制读取 十六进制查看