Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
2 votes
1 answer
126 views

What tricks can I use to manually decompile a set of instructions

ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are eax ebx ecx edx esi length of user input (min length is 3) 0 ...
3 votes
1 answer
124 views

IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text

Recently I got a program that has two colors of .text segment, one is black and the other is brown: While the flow chart and the decompiler work well on black part, they are both disabled on the ...
1 vote
0 answers
20 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
  • 11
1 vote
0 answers
33 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
0 votes
0 answers
104 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
1 vote
1 answer
45 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
0 answers
49 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
  • 111
0 votes
0 answers
89 views

Extracting contents of unknown file format

I would love some help on working with this file format. I have this archived file from this abandonware game that I like to mess around with, and I have tried all sorts to try and expand it to ...
  • 9
1 vote
1 answer
83 views

Are there websites for reverse engineering challenges similar the programming challenges? [duplicate]

As a developer, reverse engineering has always fascinated me. It amazes me to see what some people can figure out just from a dump of assembly code, and I would like to become better at doing the same....
1 vote
2 answers
219 views

Decompiling and Recompiling APK leads to crash using Apktool

Decompiling and recompiling an apk causes it to crash. My goal is simply to insert a method into smali code that prints a stacktrace, but even decompiling and recompiling with no changes causes the ...
  • 121
1 vote
0 answers
178 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
0 votes
0 answers
111 views

How to see the src of a Node.exe

Long story short, my friend sent me some scripts a while ago and lost a lot of his old source code and I wanted to see how it works but it's compiled into a node.exe (Node.js: Server-side JavaScript). ...
0 votes
2 answers
104 views

How to Convert given set of Assembly-Level Instructions to High-Level Language Code?

As I am working on malware analysis, I got stuck in a place where I have to change the given set of assembly-level instructions to high-level code. Example: Assembly Level Code mov ebp, esp ...
0 votes
0 answers
58 views

IDA Pro maps wrong variable for offset

I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
3 votes
1 answer
185 views

Reverse-engineering a 90s CNC machine (FORTH like) firmware

Here's an undertaking I'm currently in, and would absolutely love someone to assist more directly. I'll list the subjects that I would greatly appreciate more knowledge within. Know anything about one ...
2 votes
0 answers
573 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6 wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files not ...
1 vote
1 answer
133 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
  • 113
1 vote
1 answer
99 views

Decrypting .toc file

So I have a few files from a game on my pc, most of which are .toc files I believe this means they are a "table of contents" as the ending suggests, but my attempts to read them have been ...
1 vote
0 answers
77 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
  • 425
2 votes
1 answer
75 views

Decompilation output modification in IDA Pro

I am trying to modify cfunc AST from If (a1 && some_func_ptr) { some_func_ptr(); } To if (a1) { some_func_ptr(); } But I constantly get INTERR 50683 error. I tried new_item = idaapi....
  • 71
0 votes
1 answer
139 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
  • 1
1 vote
0 answers
399 views

Ida Pro can't decompile big function

I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error : The graph is too big (more than 1000 nodes) to be displayed on the screen. Switching to text mode. (you ...
  • 183
0 votes
1 answer
211 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
1 vote
1 answer
106 views

Python or C for a Qt application and security against reverse engineering

I actually have two choices : C or Python to create my application. On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
2 votes
0 answers
132 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
3 votes
1 answer
306 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
  • 131
1 vote
1 answer
32 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
  • 425
1 vote
0 answers
136 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
  • 19
2 votes
0 answers
517 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
0 votes
1 answer
157 views

Decompile obfuscated jar file

Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail. Please can someone help, I'm happy to tip for your help :) https://...
1 vote
0 answers
237 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
1 vote
0 answers
72 views

What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?

I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
  • 11
0 votes
1 answer
316 views

Deobfuscator and decompiler for .NET [closed]

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
0 votes
1 answer
207 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...
0 votes
0 answers
87 views

Harden C++ against decompilation

I have a small C++ program that contains a "secret" string that must be hard to find in the object code, e.g., #include <iostream> int main() { std::string a = "super-secret-...
1 vote
1 answer
138 views

Custom IDA Decompilation Coloring

Is there a way to customize the coloring of IDA's decompiled code? IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
  • 113
0 votes
0 answers
24 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
0 votes
1 answer
77 views

How to make Ghidra don't brake mid token with triple dots?

So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ... Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
  • 425
0 votes
0 answers
36 views

Philosophical and procedural question - Process for using x64 inline assembly in recovering source code

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
  • 763
1 vote
2 answers
605 views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
1 vote
1 answer
1k views

How to define "code" variable type in Ghidra

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
1 vote
2 answers
108 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
  • 49
1 vote
0 answers
377 views

Decompiling a Node.js application compiled with nexe

Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker. Judging by folders created in my user directory, multiple ...
1 vote
0 answers
165 views

identify the functions of stripped binaries

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
1 vote
1 answer
218 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
  • 113
2 votes
1 answer
105 views

Useless instructions in a compiled getter

This is the second time I see this kind of function today : .text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p .text:00000000000010B0 lea ...
1 vote
1 answer
267 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
  • 161
5 votes
1 answer
7k views

Decompile a NodeJS compiled program maybe by NEXE

I recently got idiotly scammed one of my discord account but kept the malware in case. Curious, I would love today to break into the executable to fetch any information about the scammer. I decompiled ...
  • 51
0 votes
0 answers
101 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
  • 176
1 vote
0 answers
39 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
  • 176

1
2 3 4 5
9