I have an app that use erlang .beam compiled files without debugging information. Someone have some tips how to decompile or reverse engineering these?
Thanks in advance
-
"7.11 Is there a "reverse compiler" for BEAM files?" (erlang.org/faq/tools.html)– JongwareCommented May 15, 2015 at 9:29
-
I already see it. But honestly did you understand how to pass to beam_lib arguments to obtain abstract_code?– itseederCommented May 15, 2015 at 10:04
-
Can't write comments, yet, so you get the link as an answer. The HelloMike challenge from the 9447 CTF was a beam file without debug_info. This writeup goes through the reversing process of the file: medium.com/@shanewilton/…– user12249Commented May 15, 2015 at 12:04
-
Following your advice and link i get that i don't have debug_info and i get an empty file if i try to decompile it with the command: erl -noshell -eval ‘hipe:c(my_beam, [pp_beam]), init:stop().’ > my_beam.disas. Do you have a tip? i get this error: (no error logger present) error: "Error in process <0.0.0> with exit value: {fun ction_clause,[{init,prepare_run_args,[{eval,[<<11 bytes>>,<<11 bytes>>,<<13 byte s>>]}]},{init,map,2},{init,boot,1}]}\n"– itseederCommented May 18, 2015 at 9:12
Add a comment
|
1 Answer
You can get low-level bytecode source of .beam file with beam_disasm:file(module_name)
It's not easy to read it and takes time to figure it out. But it's much verbose and easier to comprehend than any real hardware assembly code. You can give it a try.
For example, if you have a .beam file called "my_module.beam", open erl and type
file:write_file("/tmp/my_module_disasm", io_lib:fwrite("~p.\n", [beam_disasm:file(my_module)])).
where '/tmp/my_module_disasm' is the path where you want to save the result.
