0

I am using retdec to decompile a piece of software. It has a "kill switch" to detect if it's being run in an untrusted environment, in the decompiled code it just a simple

if (env_untrusted() == 1)
   abort()

so i'd like to remove that statement, thing is, the decompiled C code has many compilation errors. Is it possible to see what assembly corresponds to that function, and then change that assemlby to "return 0"?

also, using objdump i can generate assembly, but not in a usable format, is there a way how i can make it print in a usable format so that i can compile that assembly?

so in summary: i have decompiled an executable file using retdec into a C file. in that C file i found a function that i'd like to edit, but i cant compile the C file, so i need to find that function in the assembly, how can i do that?

and as a by producct: how can i make objdump only print out assembly

Improve this question
2
  • 1
    so, i found the answer: the objdump assembly always gives the nmemory location before the actual intruction. retdec gives the memory range per instruction. in the objdum p generated assembly just search for the memory range and done
    – user35360
    Commented Dec 28, 2020 at 12:27
  • Go ahead and answer your own question then, and mark as accepted.
    – multithr3at3d
    Commented Dec 31, 2020 at 23:38

1 Answer 1

Reset to default
1

Assuming, that executable is not packed, and if you got to the killswitch already, just select some asm commands and look for them in debugger. then you can change necessary bytes with NOP. No recompilation would be necessary at all.

Recompilation, even if successful, will make executable not exactly the same as original code.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.