6

IDA can disassemble to assembly. But, reading large assembly blocks with byte shifts, etc, is tedious work. I rather would read pseudo-code.

Are there any documents, tutorials or tools for this work targeting MIPS platform? What methods are you people using ? Sorry if this question is off-topic but normal Google search didn't yield much for MIPS.

Edit: I try to decompile modem firmware image and look for default telnet password actually since WebUI passwords dont work and my ISP does not know it too.

1
  • Well... The MIPS-support for boomerang went just due to NJML not working correctly... Better checkout my fork of smartdec/snowman where I am actively adding support atm.
    – Nihilus
    Jul 7, 2015 at 19:05

3 Answers 3

9

IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try:

  • REC - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' command, so YMMV.
  • Retargetable Decompiler - This is an online decompiler that supports various architectures, including MIPS. It's OK at getting a general idea of how the code works, but in my experience misses important details (it showed data being written to undefined pointers, for example).
  • JEB - JEB 2.3 is a professional reverse-engineering platform that supports native decompilation of MIPS 32-bit code. The output is interactive and can be refactored/modified, similarly to Hexrays'.

Ultimately, you are probably better off learning to read the disassembly. One thing that I commonly do is manually convert individual code blocks to pseudo-code; in IDA you can then right-click on a code block, select 'Group Nodes' and replace the disassembly in that code block with whatever text you want (e.g., the pseudo code). This makes it much easier to break down and understand complex functions.

6
  • I try to reverse some cable modem firmware . Which is a big single binary (eCos). I did not see any option in REC to specify loading address for raw binary. Retargetable Decompiler appears to only support ELF format. I will try your suggestion with Group Nodes.Hope I can make it. Thanks. Jan 14, 2014 at 17:59
  • ARM and x86, actually.
    – Igor Skochinsky
    Jan 14, 2014 at 19:58
  • 3
    Whoops, thanks Igor, I edited the post. @user3155036, you can wrap the code in a simple ELF header using objcopy (see example here: nycresistor.com/2012/08/21/ghosts-in-the-rom) and see how far the Retargetable Decompiler gets. Also a quick tip, since eCos is open source, I've had some success in the past building IDA FLIRT signatures for the eCos libraries; didn't catch everything of course, but it was a big help.
    – devttys0
    Jan 14, 2014 at 20:05
  • I added ELF header but could not post it to Retargetable Decompiler since 10 MB size limitation. But i was able to decompile the ELF file with RECStudio (GUI is more stable than CLI). And the result: Equally unreadable code maybe a bit shorter though. Jan 15, 2014 at 17:42
  • Tooting my own horn here. If you'd be willing to supply a MIPS binary, I could use that to improve the MIPS support of my open-source Decompiler project (sourceforge.net/projects/decompiler). Jul 8, 2015 at 15:28
4

The only MIPS decompiler I know is REC. There is also this, but I didn't try it myself.

0

try use https://github.com/drvink/epanos
from project page ElectroPaint Automatic No-source Object reaSsembler (a MIPS to C decompiler) This is a very dumb MIPS to C static translator. Consider it a proof of concept, as it has successfully worked The decompiler depends on IDA pro

best way is use IDA PRO & your brain

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.