Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
323
questions
0
votes
0answers
25 views
What are good tips to reverse engineering code with no variable name information and loss of the debug information?
I am a exploiter for roblox which mean that I execute scripts via an external program called an exploit on running roblox games. To make script for my exploits, I have to use debugging library and ...
0
votes
1answer
37 views
“check:” keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
-2
votes
0answers
47 views
Interest in adapting signal processing for reverse engineering principally from a biogenomic standpoint [migrated]
NB: This was also posted over on dsp.stackexchange.com.
I am seeking any possible help for a problem I have devoted a quite protracted period of time exploring. I am total perm disabled, and thus ...
0
votes
0answers
37 views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
81 views
Is this file compressed, and if yes what type of compression is it. And how can I find it myself
I'm once again stuck on a binary image, which seems like it might be compressed, but I can't find any way to detect the compression used, let alone decompress it.
The binary in question is from a "...
0
votes
1answer
46 views
IDA subroutine code running when not being called
Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
-1
votes
1answer
45 views
How to find where a subroutine is being called (ida)
I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
0
votes
0answers
39 views
Exporting/Importing all function info from one ghidra program to another
I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
0
votes
1answer
181 views
Seeking for explanation about ā in_FS_OFFSET ā and ā __stack_chk_fail() ā
This is the part of the picoCTF 2019 problem "Investigative Reversing 0". I've encountered the following code when using Ghidra:
if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
/*...
-2
votes
1answer
164 views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
1
vote
0answers
41 views
JEB Decompiler - Signature recognition engine
I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
38 views
How can I debug a non-main .NET assembly using dnSpy?
I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
0
votes
1answer
40 views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So lets say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions, now as far as i have seen they always contain relative offset as ...
2
votes
0answers
52 views
How to reverse engineer an exe built using nexe?
I am working on an express application. I obfuscate the source code using javascript-obfuscator.
I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
1
vote
2answers
135 views
Type reconstruction ambiguity
In TIE: Principled Reverse Engineering of Types in Binary Programs, Lee J. et al claim to solve most of the challenges in the process of C code decompilation that come with type reconstruction.
While ...
0
votes
2answers
102 views
IDA - How to resolve “Write access to const memory detected” error?
I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices ...
1
vote
1answer
196 views
How do I read this decompiled code?
I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called ParseCommandLine, but I don't understand what it is doing. I ...
0
votes
1answer
22 views
VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?
I'm trying to decompile an old binary (about 20 year old).
The program uses exceptions.
I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0.
I've tried many options ...
1
vote
1answer
123 views
Stack-pointer analysis failed
I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
0
votes
2answers
142 views
Ghidra analyzing hardcoded indirect jumps
I'm currently analyzing a function that has a lot of indirect jumps looking like the following.
LEA R10,[0x142000000]
(some instructions that dont change R10)
JMP R10
The Ghidra decompiler just ...
1
vote
1answer
70 views
Type inference inconsistency
I'm testing several decompilers against the following C code
static int bar(int i) {
return ++i;
}
static int apply(int (*fun)(int), int i) {
return i % fun(i);
}
static int foo(int (*app)(...
2
votes
1answer
71 views
IDA pseudocode support
How can I know which processors IDA knows how to view pseudocode of?
If IDA does not know to view pseudocode for my processor, how can I fix that??
2
votes
1answer
794 views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
4
votes
2answers
225 views
Struct reconstruction in decompilers
I'm testing several decompilers about struct reconstruction, given the following C example:
struct S {
int x;
int y;
long z;
long t;
};
int foo(struct S s) {
return s.x + s.y + s....
0
votes
0answers
35 views
IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions
I am currently dealing with obfuscated code in IDA.
The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
0
votes
0answers
65 views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
1
vote
0answers
36 views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
0
votes
0answers
189 views
Deconstructing Unity games
Note: I only want to edit/mod the games not trying to steal things etc.
I'm trying to deconstruct some Unity games from both PC and Android platforms and already extracted assets with uTinyRipper ...
1
vote
2answers
87 views
Can I decompile a file if I have a compiler? [closed]
Is it possible to reverse the compiled code using a compiler?
I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.
...
1
vote
1answer
163 views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
0
votes
1answer
111 views
How to decrypt a file who encryption and key is unknown? [closed]
Here is the file that I am trying to findout a way to decrypt.
settings.ini
This file is from the settings of the MetaTrader 5. The same is the name of the application.
Kindly suggest a better way so ...
0
votes
1answer
304 views
How do I reverse engineer a game using dnSpy?
I've been reading some about reverse engineering and decided to try to learn as I go, which has proven somewhat difficult. Sorry about the generic title, I'll try and give enough info so it can be ...
2
votes
1answer
222 views
Decompiler attack
I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.:
So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
3
votes
1answer
494 views
concat22 in ghidra decompiler
Some portion of code I am analyzing gets decompiled as below in ghidra:
if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) &&
(*(uint *)((int)puVar9 + 6) ==
(CONCAT22(...
0
votes
1answer
111 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
56 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
0
votes
2answers
312 views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
2
votes
2answers
161 views
Java reverse engineering tool [closed]
I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it.
I've tried PNF's JEB which is really perfect but it's only for Android stuff....
2
votes
0answers
323 views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
1
vote
0answers
38 views
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
2answers
83 views
Strings weirdly split in binary
Recently I have come across a few parts in a binary that looked odd to me, and I wanted to ask if this is something common compilers do, and if there is a way to undo it.
(The binary is from a raw ...
1
vote
0answers
57 views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
1
vote
0answers
46 views
(Help) APK Decomplied unreadable .pngs
I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
0
votes
1answer
98 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
99 views
Confusion about LEA and why it means what it does in this context
I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example.
The first part of it is fairly straightfoward-
7C921A39 MOV EDI,EDI
7C921A3B PUSH EBP
...
1
vote
1answer
576 views
Decompile large function in IDA
I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
2
votes
1answer
223 views
Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?
I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
1
vote
0answers
77 views
Calling functions of a shared object (.so) extracted from an APK
Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
0
votes
1answer
67 views
Search string in all binary pesudo-code
How can I search pesudo code string in all functions in binary with Ida??
Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)
I want to search for example where ...
1
vote
1answer
132 views
IDA Copy structure from one database instance to another
This question sounds rather simple, but I can't seem to find any option for this.
I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
