Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
403
questions
0
votes
0answers
8 views
Procyon vs CFR for Java Decompiler
I'm trying to find the best Java class decompiler thats the most reliable. What's the difference between Procyon and CFR as far as decompiling the most classes sucessfully?
1
vote
1answer
105 views
convert C++ code to python code
while I'm doing RE using ghidra i saw this code
byte bVar1;
byte bVar2;
uint uVar3;
uVar3 = 0;
while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') {
bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
1answer
39 views
why does dalvik remove invocations during optimisation?
This is original smali code of a classes.dex method before installation
.method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle;
.registers 6
new-instance v0, Landroid/os/Bundle;
...
0
votes
1answer
82 views
How to make sense of the pointer in reversed function call?
I have the code below, derived from the reversed function in the original application:
gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50));
The create function ...
0
votes
0answers
20 views
Baksmali services.odex from Android L (5.1, API22)
I'm trying to deodex a system file (/system/framework/arm/services.odex) as I need to modify it.
I've tried every possible commands found online, but
baksmali complains for "unsupported oat ...
0
votes
0answers
48 views
Ghidra: Identify and display a struct broken into multiple smaller fields
Me vs the 90s game, part two.
I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
1answer
152 views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
0
votes
0answers
64 views
IDA: Function arguments detection
I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
1
vote
0answers
47 views
ZKM 15 Deobfuscation (Jar file) [closed]
Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me.
I am willing to pay money for this.
I mostly just need Strings from the jar file. It doesn't need to be perfect.
...
0
votes
0answers
58 views
Improving Ghidra's Auto-Structure creator
I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
0
votes
1answer
107 views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
2
votes
0answers
71 views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
2
votes
2answers
254 views
Is decompilation significantly more limited when performed on handwritten assembly?
I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
0
votes
0answers
37 views
Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?
The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
0answers
71 views
How can I extract working files (in the form of graphics) from these MZP executables?
There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
2
votes
0answers
231 views
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
0
votes
2answers
129 views
convert code to python
i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc..
the first code:
void one(int param_1,int param_2) {
int ...
1
vote
0answers
50 views
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :
UmdUsFrEB3wGMuuAz1Znywuedx6+...
0
votes
0answers
115 views
How do I decode or decompile this class It seems codes are encrypted?
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.
Code:
public ...
1
vote
1answer
75 views
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
0
votes
2answers
73 views
what does an integer modulus 32 cast to (byte *) points to?
As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag.
I used GHIDRA to decompile the binary.
The encryption ...
0
votes
1answer
225 views
Modifying program using IDA/Hexrays decompilation pseudocode
A bit long-winded, apologies in advance. Updates to the question are at the end.
I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
0
votes
0answers
57 views
Change PHP Function behaviour on a encrypted file
I have a PHP file that is encrypted with Ioncube. Searching on the internet I found one guy which has decoded it, but when I run the decoded file, the code behavior changes so I can't replace the ...
0
votes
1answer
64 views
Is the code like this reverse able? (from Assembly - UnityScript)
i try to reverse this code but cant figure it out what is this number mean or how to call it...
0
votes
1answer
157 views
What are the way I can reverse engineer an obfuscated C++ program?
I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
3
votes
1answer
103 views
Specifying the register value which is constant for all the functions
In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables.
e.g. register r13 is set to 0x40000000 which ...
0
votes
0answers
32 views
IDA Pro having issue decompiling gcc compiled ELF64 function with more than one leave/ret
I am new to IDA Pro and am not familiar with anything beyond default settings for decompilation. I have an ELF64 kernel module compiled with gcc and, in several cases, IDA Pro's decompilation is ...
0
votes
1answer
33 views
How to force a program to run as monothread for dynamic analysis?
I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
0
votes
1answer
102 views
How to export arm64 and x86-64 binary into one?
I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes.
When I tried to export it, it exported a .bin file that ...
0
votes
1answer
46 views
Reverse engineering mode X VGA function(s)
I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
1
vote
0answers
38 views
Ghidra SDK Register TypeFlags are not populated
I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
2
votes
1answer
88 views
Can obfuscation be applied on certain parts?
I am newbie to this field. I am still learning from your wonderful contributions, help and guidance.
I have had an app that i want to study in-depth. How the the it is constructed? What components ...
1
vote
1answer
77 views
Converting a data address offset to the equivalent struct in a C++ module
I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so:
v32 = ( v3 + ...
0
votes
2answers
969 views
Modifying UnityPlayer.dll with dnSpy or other
I've been looking into reverse engineering a game developped with Unity 2017.4.10, to find a way to get a freely controlled camera. I found the values that interest me in Managed/Assembly-CSharp.dll ...
0
votes
1answer
2k views
How can I modify or decompile Hermes JS bytecode?
Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode.
The Hermes documentation mentions hbcdump ...
0
votes
1answer
37 views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
1
vote
1answer
196 views
Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?
I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
2
votes
0answers
110 views
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
3
votes
2answers
218 views
How can I get xrefs to class member variables in IDA?
I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.
I want to know how I can get a list of all references to a given class member ...
2
votes
1answer
168 views
How to reverse engineer cx_Freeze exe's?
How to reverse engineer Python scripts turned into binaries with cx_Freeze?
0
votes
1answer
102 views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
0
votes
1answer
61 views
Custom IDA Decompilation Format
Is there a way to customize the format of IDA's decompiled code?
e.g.
char buf[7]; // [rsp+5h] [rbp-1Fh]
to
char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]
or
switch (c)
to
switch( c )
1
vote
1answer
104 views
Can you decompile code if you Know the Complier?
My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to ...
4
votes
2answers
349 views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
0
votes
1answer
141 views
How to inform Hex-Rays decompiler (7.0) of known register values?
I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
-1
votes
1answer
455 views
Extract PYZ Error
I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
0
votes
0answers
77 views
Volatile data Ghidra
Is it possible to set a local stack variable volatile? I'm trying to reverse a program full of concurrent threads which exploit this mechanism: https://en.wikipedia.org/wiki/Setcontext to obfuscate ...
4
votes
0answers
250 views
Legality of publishing decompiled code
The situation is the following:
Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86).
The binary file does not contain any symbols or ...
0
votes
1answer
55 views
Understanding how a WiFi camera app goes from packet data to video stream
I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte ...
1
vote
1answer
222 views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
