1

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:

; code
pxor    xmm0, xmm0
ucomiss xmm0, xmm1
ja      short loc_67F31600                          
movss   xmm2, cs:dword_6854E3C0
comiss  xmm1, xmm2
jbe     short loc_67F31630
movups  xmm1, xmm2
jmp     short loc_67F3160B

; subroutines
loc_67F31600:
    movups  xmm1, xmm0
    movss   xmm0, cs:dword_6854E3C0

loc_67F31630:
    movups  xmm3, xmm1
    movups  xmm0, xmm1
    movss   xmm4, cs:dword_6854E43C
    addss   xmm3, xmm1
    subss   xmm0, xmm2
    mulss   xmm1, xmm4
    movups  xmm5, xmm3
    addss   xmm2, xmm3
    mulss   xmm0, xmm4
    subss   xmm5, xmm4
    divss   xmm1, xmm2
    divss   xmm0, xmm5
    jmp     short loc_67F3160B

loc_67F3160B:
    movss   dword ptr [rcx+102F0h], xmm0
    movss   dword ptr [rcx+102ECh], xmm1
    movss   dword ptr [rcx+160h], xmm0
    movss   dword ptr [rcx+1D4h], xmm1
    retn

Is there a way (with the same tool) to retrieve a more readable source code from it? Should I need IDA Pro? Can you show me the steps to do it? (so I can evaluate a purchase).

Or which kind of other tools can you suggests to do the same? I mean: at least get C++ standard operations, with the real values placed on arrays and stuff (if possible, of course).

Improve this question
2
  • 1
    the quality of the different decompilers can differ vastly. In all cases what you get is pseudo code, meaning it attempts to show what the assembly is doing in a more high level language. But it likely would never compile out of the box. Logically since the pseudo code is usually C, even though the original code may have been C++ or some different language altogether, the results can vary a lot. You could attempt to use dogbolt to evaluate which one is suited the best (their FAQ also lists other options).
    – 0xC0000022L ♦
    Commented Sep 7, 2022 at 10:57
  • 1
    pseudo code is exactly what I'm looking for right now, in a way that I can build on top "concrete" source code.
    – markzzz
    Commented Sep 7, 2022 at 13:49

1 Answer 1

Reset to default
3

For IDA Pro there are decompiler plugins available that can generate a code similar to C (if everything goes well). But IDA Pro + decompiler for the architecture you need is pretty expensive (1975 USD + 2765 USD).

A cheaper way to get decompiled code would be Ghidra, it includes a decompiler.

In both cases the generated code can be good or bad or even wrong. That depends on the code to be decompiled.

If you already have IDA Pro you can can also try to integrate Ghidra decompiler into IDA using the open source IDA plugin GhIDA.

Improve this answer
1
  • 2
    I think the RetDec integration and yagi as an alternative to GhIDA are also worth a mention.
    – 0xC0000022L ♦
    Commented Sep 7, 2022 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.