Topic created on: November 7, 2008 15:59 CST by dmitry32 .

I am looking for a way to create a PE file from an IDA Pro disassembly. I figured out that IDA is able to create a .asm dump of the current database, but all my attempts to assemble and link this file have failed. I tried with MASM 6, the current MASM, TASM and some other, less-known assemblers, but all seem to have trouble with the syntax of the file. The following are the first few lines of MASM (9) 's litany of errors which it produces when given IDA's asm dump.

C:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\bin>ml.exe t6.asm
Microsoft (R) Macro Assembler Version 9.00.30729.01
Copyright (C) Microsoft Corporation.  All rights reserved.

Assembling: t6.asm
inc.inc(21) : error A2179:structure improperly initialized
inc.inc(21) : error A2008:syntax error : in structure
t6.asm(161) : error A2001:immediate operand not allowed
t6.asm(1298) : error A2189:invalid combination with segment alignment : 512
t6.asm(2696) : error A2005:symbol redefinition : hInstance
t6.asm(2716) : error A2005:symbol redefinition : hWnd
t6.asm(2717) : error A2189:invalid combination with segment alignment : 256

These are the first few lines of my IDA dump with IDA's comments removed, t2.inc is an include file containing all symbolic constants also created by IDA.

.686p
.mmx
.model flat
include t2.inc
_text segment para public 'CODE' use32
assume cs:_text
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing

public start
start proc near
push 0 ; lpModuleName
call GetModuleHandleA
mov hInstance, eax
call GetCommandLineA
mov hInstance_0, eax
push 0Ah ; int
push hInstance_0 ; int
push 0 ; int
push hInstance ; hInstance
call main
push eax ; uExitCode
call ExitProcess
start endp

main proc near
hWnd= dword ptr -50h
Msg= tagMSG ptr -4Ch
var_30= WNDCLASSEXA ptr -30h
hInstance= dword ptr  8

push ebp


While I did try to manually make the file compatible with MASM (basically by removing ALIGN directives, including EXTRN statements and renaming variables), this is not a practiable solution given the size of the executable.

Do you have any suggestions on how get an IDA output file assembled correctly with little or no manual editing?

[Btw... I literally spent hours looking this up on Google with nothing useful turning up. What do the more expierienced reverse code engineers do when, for example, solving a crackme which needs more than simple instruction-wise patching?]

Thanks in advance
Dmitry

EDIT: Forgot to add: I know that the PE file I would get if I could assemble IDA's dump would be lacking all resource data. This, however, is irrelevant for my work; I only care about code.