Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
0
votes
0answers
51 views
It is possible to parse this MBR? [on hold]
It is possible to parse this MBR (Master Boot Record)?
00000000 eb 3c 90 4f 70 65 6e 42 53 44 00 00 02 02 00 00 |.<.OpenBSD......|
00000010 00 00 00 00 00 f8 00 00 00 00 00 00 10 00 00 00 |.....
0
votes
1answer
44 views
Search string in all binary pesudo-code
How can I search pesudo code string in all functions in binary with Ida??
Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)
I want to search for example where ...
1
vote
1answer
36 views
IDA Copy structure from one database instance to another
This question sounds rather simple, but I can't seem to find any option for this.
I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
1
vote
0answers
44 views
Can you change the architecture in Ghidra after importing?
I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
1answer
85 views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with virtual machine : the problem is it's not opcode anymore it's bytecode which I don't have any idea about because it's a private virtual ...
1
vote
0answers
23 views
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?
...
2
votes
0answers
85 views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
0
votes
0answers
30 views
(Help)Apk Decomplied unreadable files
I'm developing an android-based game for my school project.
I chose an .apk to reference the visual parts.
I've decompiled the .apk file I've specified. I can't view the image files I need.
files ...
3
votes
1answer
270 views
How do I import function signatures to Ghidra?
I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
0
votes
1answer
97 views
Is it possible to recover the key to a decrypted file?
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how?
The file I want to recover the key from is a xml that looks like ...
4
votes
1answer
199 views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
1answer
95 views
De-obfuscating code ran through JScrambler 3x via Eval() functions
I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
43 views
deobfuscating/decompiling extremely complicated javascript [closed]
I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this
U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
0
votes
1answer
133 views
Unable to decompile C Code
Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
3
votes
0answers
379 views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
1answer
108 views
Decryption loops
I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:
for ( i = 0; i < n; ++i )
{
v22 = *((_BYTE *)sub_5657D89B + i);
v0 = v22 ^ 0x90;
v1 = strlen(&...
-1
votes
1answer
112 views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
1
vote
0answers
28 views
Is there any way to execute Hopper scripts from command line?
What should I do if I have a batch of binaries to decompile with Hopper?
I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
0
votes
1answer
110 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
0
votes
0answers
62 views
How to decompile these LUAs from the Bookworm Adventures games?
I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
0
votes
0answers
70 views
Taking a luac file and making a modification
I have a luac file for a program I use. I'd like to make a modification to this file to call a function from another luac script. My understanding of the way luac works is the first few bytes are the ...
0
votes
1answer
50 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
1answer
463 views
Impossible to execute a program with radare2 : TO DO continue
I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
2
votes
0answers
136 views
Reconstruct InnoSetup file with existing CompiledCode.bin
Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option.
Basically ...
0
votes
1answer
306 views
How can I make IDA understand this switch statement with a signed jump table?
I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:
int main() {
int a = 0;
for (int i = 0; i < 5; i++) {
switch (i) {
case 0:
a = 1;
break;
...
4
votes
1answer
273 views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
0answers
28 views
How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?
When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
126 views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
0
votes
1answer
124 views
Multiple decompilation failure with ntoskrnl
IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that:
I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
3
votes
1answer
443 views
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
Given the following short assembly snippet:
shr rax, 3
adc rax, 0
I worked this out a bit:
We know SHR sets the CF with the last bit shifted.
We know ADC dest, 0 is just adding the CF.
So ...
2
votes
1answer
335 views
Converting Assembly x64 code to C
I have the following code:
0000000000400526 <main>:
400526: 55 push rbp
400527: 48 89 e5 mov rbp,rsp
40052a: 48 83 ec 20 sub ...
1
vote
1answer
142 views
Figuring out what a segment of assembly code does
I have the following assembly code:
0000000000400711 <foo>:
400711: 55 push rbp
400712: 48 89 e5 mov rbp,rsp
400715: 48 89 7d e8 ...
1
vote
0answers
103 views
Need help understanding IDA Pro pseudocode
I am new into IDA and have some questions about the pseudocode in C.
Could someone please explain to me the meaning of the following two lines:
(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
0
votes
1answer
992 views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
4
votes
1answer
236 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
0
votes
1answer
285 views
What is the password to this file? I can't figure it out with radare2 or gdb
Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing
I am able to figure out some of the assembly, but can't get the correct password. I know ...
1
vote
1answer
975 views
How do the AI in Pokemon battles work?
Has anyone ever attempted to decompile the code for a Pokemon game and figure out how the battle AI works? e.g. How it decides which move to use, or use a Potion/even withdraw based on the current ...
1
vote
3answers
128 views
How to identify the purpose behind a bitmask?
The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly:
mov r8d, 0FFFFFFF8h
...
2
votes
1answer
50 views
Do all class instances have a relative address/offset and can i make a copy of any class pointer?
I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such.
And I have applied that to some of my own code in the past.
But does this practice ...
-3
votes
1answer
136 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
0
votes
1answer
343 views
Generate c like pseudo code from objdump output
Ida has a feature which generates pseudo code from assembly.
Is there a tool under Linux that make the same job, from objdump output for example ?
2
votes
0answers
116 views
Show parameters stored in stack with __fastcall in IDA
This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.
mov [rsp+32], rdx ...
2
votes
1answer
169 views
Android 7.0+ Monitoring application HTTPS requests
I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining ...
1
vote
1answer
337 views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
4
votes
1answer
326 views
Resolving FLAGS bits with IDA
While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
176 views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
2
votes
1answer
534 views
How to unpack Inno Setup bundles with Arc+SREP data?
I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods:
the installer didn't work for an ...
2
votes
0answers
88 views
Hopper: What does stack[xxxx] mean?
When using the 'decompiler' tool in Hopper on the start function of an application it shows this:
What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
1
vote
2answers
2k views
IDA Hex-Rays Decompiler : Show strings instead of offset
How can i settings IDA show me string instead of offset_xxx?
4
votes
1answer
198 views
Help understand decompiled IDA code
I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks!
File : https://www.sendspace.com/file/3yowjg
Password : 1
void __fastcall sub_A513C0(char *Src, HWND ...
