Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
346
questions
5
votes
2answers
131 views
What kind of function creates this code pattern?
Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.
I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
-1
votes
1answer
90 views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
-3
votes
1answer
97 views
How to reverse engineer apks? [closed]
is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
1
vote
1answer
57 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
2
votes
1answer
98 views
How to prevent Ghidra from removing unreachable blocks?
I am using this extension for loading PS-X executables:
https://github.com/lab313ru/ghidra_psx_ldr
During decompilation, Ghidra shows some of these warnings:
WARNING: Removing unreachable block (...
1
vote
1answer
55 views
Issue understanding simple ARM ASM function
I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
0answers
42 views
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've
used flashrom and a soic8 clip to dump the bios to a bios.img file
made another dump and compared with diff bios....
0
votes
0answers
102 views
What are the known techniques used by wrappers and obfuscators to protect against decompiling?
I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
0answers
121 views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
-1
votes
1answer
60 views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
0
votes
2answers
89 views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
1
vote
2answers
114 views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
2
votes
1answer
52 views
Ghidra Python - cancel decompilation task
The way to decompile a function in Ghidra Python is:
decomp = DecompInterface()
decomp.openProgram(currentProgram)
decompile = decomp.decompileFunction(func, 1000, monitor)
However, in ...
0
votes
0answers
50 views
Force gcc to use more complex instructions
I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...
4
votes
1answer
106 views
How to improve Ghidra decompilation of SSE instructions?
In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
1
vote
2answers
85 views
Working with strong obfuscated Java
I've got a jar file, that is strong obfuscated.
When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters.
I tried to deobfuscate it ...
1
vote
0answers
69 views
Fixing ghidra decompilation
i am working a little bit with Ghidra.
My assembly code doesn't match with the decompiled code:
* FUNCTION *
...
1
vote
1answer
53 views
What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?
Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc.
I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
0
votes
0answers
31 views
inspecting c-sky elf application
I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver
the receiver is based on c-sky v1 architecture
searching forums , I managed to get the firmware ...
-1
votes
1answer
46 views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
0
votes
0answers
111 views
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
1answer
68 views
Ghidra Python - Get Decompile Line Text by RVA
Is there a way in Ghidra Python to get the corresponding decompile line by RVA?
Or the opposite - get the corresponding RVA from a given line in a decompile?
2
votes
1answer
69 views
Find password in a c compiled binary file
I'm currently learning to do some basic reverse engineering of binary files using Cutter. The program i'm struggling on test if the password entered as argument is correct, if not, return an error ...
0
votes
1answer
44 views
structures defined on stack?
While reading this paper on type recovery from executables, I came across following paragraph:
It is worth noting that the domain of parameters of a function can be
considered as a structure ...
0
votes
0answers
84 views
What are good tips to reverse engineering code with no variable name information and loss of the debug information?
I am a exploiter for roblox which mean that I execute scripts via an external program called an exploit on running roblox games. To make script for my exploits, I have to use debugging library and ...
0
votes
1answer
67 views
“check:” keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
0
votes
0answers
69 views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
87 views
Is this file compressed, and if yes what type of compression is it. And how can I find it myself
I'm once again stuck on a binary image, which seems like it might be compressed, but I can't find any way to detect the compression used, let alone decompress it.
The binary in question is from a "...
0
votes
1answer
50 views
IDA subroutine code running when not being called
Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
-1
votes
1answer
49 views
How to find where a subroutine is being called (ida)
I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
1
vote
0answers
133 views
Exporting/Importing all function info from one ghidra program to another
I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
1
vote
1answer
602 views
Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”
This is the part of the picoCTF 2019 problem "Investigative Reversing 0". I've encountered the following code when using Ghidra:
if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
/*...
-2
votes
1answer
573 views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
1
vote
0answers
55 views
JEB Decompiler - Signature recognition engine
I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
84 views
How can I debug a non-main .NET assembly using dnSpy?
I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
0
votes
1answer
63 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
2
votes
0answers
73 views
How to reverse engineer an exe built using nexe?
I am working on an express application. I obfuscate the source code using javascript-obfuscator.
I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
1
vote
2answers
141 views
Type reconstruction ambiguity
In TIE: Principled Reverse Engineering of Types in Binary Programs, Lee J. et al claim to solve most of the challenges in the process of C code decompilation that come with type reconstruction.
While ...
0
votes
2answers
194 views
IDA - How to resolve “Write access to const memory detected” error?
I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices ...
1
vote
1answer
392 views
How do I read this decompiled code?
I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called ParseCommandLine, but I don't understand what it is doing. I ...
2
votes
2answers
50 views
VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?
I'm trying to decompile an old binary (about 20 year old).
The program uses exceptions.
I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0.
I've tried many options ...
1
vote
1answer
160 views
Stack-pointer analysis failed
I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
0
votes
3answers
387 views
Ghidra analyzing hardcoded indirect jumps
I'm currently analyzing a function that has a lot of indirect jumps looking like the following.
LEA R10,[0x142000000]
(some instructions that dont change R10)
JMP R10
The Ghidra decompiler just ...
1
vote
1answer
74 views
Type inference inconsistency
I'm testing several decompilers against the following C code
static int bar(int i) {
return ++i;
}
static int apply(int (*fun)(int), int i) {
return i % fun(i);
}
static int foo(int (*app)(...
2
votes
1answer
101 views
IDA pseudocode support
How can I know which processors IDA knows how to view pseudocode of?
If IDA does not know to view pseudocode for my processor, how can I fix that??
2
votes
1answer
2k views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
4
votes
2answers
251 views
Struct reconstruction in decompilers
I'm testing several decompilers about struct reconstruction, given the following C example:
struct S {
int x;
int y;
long z;
long t;
};
int foo(struct S s) {
return s.x + s.y + s....
0
votes
0answers
40 views
IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions
I am currently dealing with obfuscated code in IDA.
The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
103 views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
1
vote
0answers
42 views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
