Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
2
votes
1answer
107 views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
1
vote
1answer
78 views
Figuring out what a segment of assembly code does
I have the following assembly code:
0000000000400711 <foo>:
400711: 55 push rbp
400712: 48 89 e5 mov rbp,rsp
400715: 48 89 7d e8 ...
1
vote
0answers
54 views
Need help understanding IDA Pro pseudocode
I am new into IDA and have some questions about the pseudocode in C.
Could someone please explain to me the meaning of the following two lines:
(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
0
votes
1answer
146 views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
4
votes
1answer
79 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
0
votes
0answers
31 views
Exception while decompiling C# Windows application
I'm pretty new to RE, decompiling and stuffs. and my first time posting here.
Recently I tried de-compiling a Windows app written in C#. I use Just Decompile.
The decompiled code however shows some ...
-1
votes
0answers
26 views
IDA unable to resolve local var
I'm decompiling a function and as you can see I've finished most of the parts, yet still left some annoying v1 - 0x1D4 unsolved. Here v1 is EBP, so these annoying stuff must be local vars. Then why ...
-1
votes
0answers
58 views
How can i extract all program variables from a binary file? [duplicate]
i'm participating a cyber security challenge, and one of the topic, is to analyze a binary file and extract an hard coded password to open a protected zip file.
Now, i tried to turn the binary file ...
0
votes
1answer
101 views
What is the password to this file? I can't figure it out with radare2 or gdb
Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing
I am able to figure out some of the assembly, but can't get the correct password. I know ...
0
votes
0answers
51 views
How to change value in IDA pseudocode?
If I press F5in ida, I can see pseudocode.
When I debug this pseudocode, I can see values of variables.
How can I change the value of specific variable in pseudocode?
0
votes
0answers
77 views
Where is Hasp Sentinel LDK (NO DONGLE) license information stored. H0045
I am trying to hack hasp sentinel LDK and have managed to create a spoofed time service for HASP. At the minute I have a trial which thanks to the crack lasts forever. However, the issue is during ...
1
vote
1answer
560 views
How do the AI in Pokemon battles work?
Has anyone ever attempted to decompile the code for a Pokemon game and figure out how the battle AI works? e.g. How it decides which move to use, or use a Potion/even withdraw based on the current ...
1
vote
3answers
81 views
How to identify the purpose behind a bitmask?
The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly:
mov r8d, 0FFFFFFF8h
...
2
votes
1answer
38 views
Do all class instances have a relative address/offset and can i make a copy of any class pointer?
I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such.
And I have applied that to some of my own code in the past.
But does this practice ...
-3
votes
1answer
48 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
0
votes
1answer
107 views
Generate c like pseudo code from objdump output
Ida has a feature which generates pseudo code from assembly.
Is there a tool under Linux that make the same job, from objdump output for example ?
2
votes
0answers
60 views
Show parameters stored in stack with __fastcall in IDA
This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.
mov [rsp+32], rdx ...
2
votes
1answer
94 views
Android 7.0+ Monitoring application HTTPS requests
I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining ...
1
vote
1answer
91 views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
3
votes
1answer
82 views
Resolving FLAGS bits with IDA
While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
98 views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
2
votes
1answer
83 views
How to unpack Inno Setup bundles with Arc+SREP data?
I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods:
the installer didn't work for an ...
2
votes
0answers
47 views
Hopper: What does stack[xxxx] mean?
When using the 'decompiler' tool in Hopper on the start function of an application it shows this:
What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
1
vote
2answers
228 views
IDA Hex-Rays Decompiler : Show strings instead of offset
How can i settings IDA show me string instead of offset_xxx?
4
votes
1answer
116 views
Help understand decompiled IDA code
I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks!
File : https://www.sendspace.com/file/3yowjg
Password : 1
void __fastcall sub_A513C0(char *Src, HWND ...
1
vote
0answers
57 views
Decompiling or modifying .exe file generated from .jar
I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
0
votes
0answers
126 views
IDA: NEC V850. Unable to identify anything
I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all.
In order to do that, I select a V850 or V850E1 processor type and ...
1
vote
0answers
34 views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
3
votes
1answer
77 views
What are the steps to reverse engineering a Shockwave .DCR file?
I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
1
vote
1answer
134 views
Would it be possible to reverse engineer a game's rom file to get source code?
More specifically, could you get low level code from a rom, and piece it together and translate it to a higher level language?
5
votes
1answer
340 views
dnSpy - What do these symbols mean?
When decompiling a dll file there are certain lines of code that read like this:
return \u0013.\u0002.\u0001(url, info);
I have two questions on this:
1) does \u00xx mean that it is obfuscated, if ...
1
vote
0answers
50 views
Reverse engineering IE thick client
Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO).
In trying to reverse one such thick client I noticed that the website downloads about ...
3
votes
1answer
77 views
Disassemble/decompile arbitrary JVM bytecode
I have an obfuscated java binary which does runtime code injection using java reflection like this.
Object o = "a long string";
((Method)o).invoke(params..);
(If I write this in a java file, it ...
-1
votes
1answer
78 views
Fixing IDA Member functions argument order
When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type ...
5
votes
3answers
325 views
What exactly is binary disassembly and what it produces?
The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...
2
votes
1answer
70 views
How to do i fix it when IDA pro mislabels values as loc_
Some times the psuedo code generated by IDA is baffling
v8 = (signed int)&loc_100010; //ida
v8 = 0x100010; //actual code
This is not so bad when it is just one value but sometimes the offset for ...
1
vote
1answer
276 views
De-compiling a random file format to retrieve the files?
Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files.
I've read multiple posts that mention ...
0
votes
2answers
211 views
verifyError in youtube android app modification
I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error:
E/AndroidRuntime(1782): java.lang.VerifyError: ...
0
votes
0answers
72 views
C code extraction from binary code
I have binary file from microcontroller MPC5674F - 32bit Power Architecture, e200z7 core. When I open it with hex redactor I see C headers, which I would like to unpack. Tried to open file with IDA ...
1
vote
2answers
407 views
.NET: It's possible to recover original source code from compiled .exe when I have all the .vshost, .pdb and compiled files?
I have the compiled code with all .pdb, vshost and everything that is generated.
I am already using DotPeek without too much hassle. Would like to know If I can retrieve the original code with all the ...
1
vote
3answers
234 views
Android- hiding private keys in .so file
I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
4
votes
1answer
118 views
How to tell if a particular .NET assembly was written in C# or F#?
The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code.
Why does decompiling an F# assembly produce C# ...
1
vote
0answers
119 views
IDAPython Decompile - connect assembly to pseudo-code line
I'm trying to write a small application that can show for each
line of the de-compiled psuedo code of a certain function
the assembly instruction that responsible for it.
for example if we have a ...
1
vote
5answers
202 views
C representation of simple assembly
I have the following very simple X86 assembly:
shr cx, 1
jae short <addr>
So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
1
vote
1answer
101 views
Static Offset in PE
I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.
The problem is I use a part of code into the main function to search the opcodes from .text section ...
1
vote
1answer
77 views
Macho - remove a LOAD COMMAND from iOS binary
I want to remove a LOAD_COMMAND from my iOS app binary.
I tried jtool:
jtool -rC 3 my_app_binary
This worked when I was removing a dynamic library. But it generated an empty binary file and the ...
0
votes
3answers
367 views
Tool besides ida to get high level code
I looking another tool besides ida to get high level code from binary file.(like oda pesudocode)
I know that the high level is not perfect on every tool, but I want try another tool.
My code compile ...
0
votes
1answer
93 views
How add String.equals to java bytecode (Krakatau)
I use Krakatau to edit java code.
class test{
public boolean Func2(String text)
{
if(text=="aaaaaa")
return true;
return false;
}
}
When I compile it I get this java bytecode
....
1
vote
1answer
106 views
Tools to translate x86-64 ELF to PPC (or i386 decompilation)
I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC.
Is there a tool that can either:
Translate the binary from x86-64 to PPC (...
1
vote
1answer
51 views
Object references representation in pseudocode
I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects.
Let's say I'm looking at a line of code in a function called ...
