Skip to main content

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

How to find what are all the third party apps used in an android app manually by decompiling an apk

How to find all the Third Party Libraries (TPLs) used in an android app after de-compiling apk using jadx? I have looked at this answer but this is too vague. I can use tools such as Libradar etc. but ...
Vamsi's user avatar
  • 1
0 votes
0 answers
24 views

What's the best way or approach to debug binary Linux library?

I've got a header file (I know the functions and have some documentation) and a .so file: From a wrapper library and from context, I need to call "Connect", but it does not work, just fails ...
Harry Blauberg's user avatar
1 vote
1 answer
87 views

Kawai ES110 - Firmware supplied as MIDI file, what can we do?

The firmware for this digital piano is supplied as a MIDI file with an EasyPlayer.exe (not sure if Wine can run this properly) binary to upload it. I'm wondering if there's a way to get at it's ...
Luke A. Guest's user avatar
0 votes
0 answers
42 views

Find Dereference And Write to Offset of Pointer

I want to find objects within a large C++ codebase that have a function that writes to 16 bytes offset off a pointer stored in an instance variable. So for example given the code has: MyClass object1 =...
098029384098's user avatar
0 votes
0 answers
36 views

Stuck on trying to understanding local TCP communication for a smart home app

I am trying to write a Home Assistant integration to control smart lights and other smart devices from a certain manufacturer locally (it is a local manufacturer who have their own app which is not ...
Mazemeshane's user avatar
0 votes
0 answers
60 views

Make a reverse engineering for dead app

Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
AWS NEBRAS's user avatar
0 votes
1 answer
45 views

Is there any way to read the data in STC11F02E?

I need to read the data from the STC11F02E microcontroller. Is there a way to do this?
akifh's user avatar
  • 1
1 vote
1 answer
80 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
1 vote
1 answer
103 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
Grandmaster's user avatar
1 vote
0 answers
110 views

How to decrypt Zyxel's 'Backup_Restore' config file?

I have a VMG3625-T50B running an ISP-dedicated firmware version (V550ABTL0b2r). I managed to get the supervisor password yet I can't enable open an SSH port because my SP disabled that option. I've ...
Khalid's user avatar
  • 11
1 vote
1 answer
50 views

Get the jar from exe4j executable

I've read this question and it is not a duplicate to mine. I have a .exe file which has different contents inside when opened with 7zip. However let's say I know that it uses EXE4J, how can I ...
Grinding For Reputation's user avatar
0 votes
0 answers
83 views

Decompiling very heavily obfuscated JAR

I have a very very obfuscated jar. I tried using Krakatau and CFR and it won't decompile. With CFR some of the important classes / methods fail to decompile and with krak it says it is writing data to ...
tritheo's user avatar
0 votes
0 answers
23 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
notabot's user avatar
0 votes
0 answers
81 views

Deobfuscating WPF obfuscated code

The project uses WPF : What should i do for XAML links de4dot supporting that ? I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
Waltcher's user avatar
0 votes
0 answers
57 views

Attempting to auto reverse XOR

Does anyone know of any helpful tools or a way to automate decryption of XOR in IDA? I know that they have a built in function to do some bare XOR encryption but this one seems a bit more ...
Babyhamsta's user avatar
0 votes
0 answers
65 views

Resizing variables to improve decompilation results

Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results: As you can see, we have what ...
F.Webber's user avatar
  • 101
0 votes
0 answers
57 views

Is there a way to access the background calculation & data in a .exe coded in fortran 30+ years ago?

The company I work for has an ancient (circa 1989-1992) program coded in Fortran that is used for sizing and selecting some of our products. We are going through a modernization project with the goal ...
JMG656's user avatar
  • 1
0 votes
0 answers
66 views

Decompile or analyse injected /usr/bin/cat

I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable. Need some tips as a beginner how to find the injection method if it'...
Dany Burgos's user avatar
0 votes
0 answers
138 views

APK/Apktool If I decompile and recompile sources the app does not start

I'm trying to reverse an apk but there is a strange thing that happens, probably something new for me, basically if I decompile only the resources (not dex files) and recompile it zipalign/sign, the ...
zwave's user avatar
  • 1
0 votes
0 answers
95 views

Reverse engineering Objective-C blocks

I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
jony cachez's user avatar
1 vote
0 answers
80 views

Freeware x86 decompilers for Windows with debug? [closed]

I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables. That above was a quick ...
Alby87's user avatar
  • 111
0 votes
0 answers
99 views

How to exclude "Process Monitor" from Themida's list of monitoring programs

Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags? I want to exclude Sysinternals "Process Monitor&...
Coldblackice's user avatar
0 votes
1 answer
366 views

i need software to decode this subtitle xml file, anyone know what it encodes with?

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt? Subtitle link xml
Đức Nguyễn's user avatar
1 vote
0 answers
281 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar
0 votes
1 answer
102 views

Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing

Goal: Trying to reverse encrypter to decrypter that successfully decrypts. This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
Brandon Gregory's user avatar
-3 votes
1 answer
1k views

Is it possible to decompile ex5? What are some hints in how one would do so?

I am creating an expert advisor. I am wondering how people can decompile the ex5 to mq5 for meta trader. Does anyone have any insight on this?
The Coder's user avatar
0 votes
1 answer
101 views

ELF - Why does objdump provide a wrong byte value in the .got?

I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert. $ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test test: file format ...
chilliefiber's user avatar
2 votes
1 answer
161 views

How to define a 28-bit integer in Ghidra

I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra. I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
Vincent Guttmann's user avatar
0 votes
1 answer
4k views

What are some methods to reverse a ex5 file for metatrader 5?

What are some methods to reverse a ex5 file, for metatrader 5? I would like to understand how people crack ex5 files and make them for use. Any ideas of reverse engineering tools for this scenario?
The Coder's user avatar
2 votes
0 answers
59 views

How to find where an instance variable of some object is set to some concrete value?

I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
Thorsten Schöning's user avatar
2 votes
1 answer
240 views

How to map a decompiled c program back into original source code

I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update). So is ...
user3368585's user avatar
1 vote
0 answers
85 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
2 votes
0 answers
108 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
5 votes
1 answer
218 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
Cesar Canassa's user avatar
2 votes
1 answer
102 views

Stuck decompiling ARM64 function

I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY. As far as I can tell, it reads the raw sensor ...
duckblaster's user avatar
3 votes
1 answer
238 views

IDA Decompiler generates wrong output on array of structures!

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is: MOV i, i,LSL#4 LDR R4, =arr_of_struct ADD i, i, R4 LDR ...
E.A's user avatar
  • 171
5 votes
2 answers
643 views

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines? MOV R1, #100 -> MOV R1, #(5 * 20) LDR R8, =var | ...
E.A's user avatar
  • 171
4 votes
3 answers
546 views

Help disassembling a simple 16-bit NE function

I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required. I would assume ...
jttri777's user avatar
  • 165
2 votes
0 answers
242 views

Why i cant see source code from this dll

// PE file does not contain any managed metadata.
Zeko It's user avatar
  • 21
1 vote
0 answers
34 views

Santander US - app

I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. ...
Guilherme Klesse de Miranda's user avatar
2 votes
0 answers
651 views

Decompiling an APK of Unity framework with IL2CPP

Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed? I tried stuff like https://github.com/Perfare/...
forvev's user avatar
  • 21
4 votes
1 answer
3k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
3 votes
1 answer
83 views

Double constructor when reversing Unity game

When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set. Here is an example: ...
Irbis77's user avatar
  • 328
3 votes
1 answer
148 views

Linux Kernel for embedded platform - Available Sources but no configuration

I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
KiralyCraft's user avatar
2 votes
0 answers
126 views

I trying rewrite asm to c++ [closed]

This code generates an API key. I use it in an android app as .so file, but I need to rewrite it to java from c++. How do I translate? push rbp push r15 push r14 push r13 push r12 push ...
Master's user avatar
  • 21
3 votes
1 answer
199 views

What tricks can I use to manually decompile a set of instructions

ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are eax ebx ecx edx esi length of user input (min length is 3) 0 ...
Mr. Kelsey's user avatar
4 votes
1 answer
338 views

IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text

Recently I got a program that has two colors of .text segment, one is black and the other is brown: While the flow chart and the decompiler work well on black part, they are both disabled on the ...
user239216's user avatar
2 votes
0 answers
47 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
2 votes
0 answers
39 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
123 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
Mr Xero's user avatar
  • 21

1
2 3 4 5
10