Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
1 vote
0 answers
43 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
user avatar
  • 111
1 vote
1 answer
20 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
user avatar
  • 413
1 vote
0 answers
57 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
user avatar
  • 19
0 votes
0 answers
25 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
user avatar
1 vote
0 answers
34 views

Decompile obfuscated jar file

Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail. Please can someone help, I'm happy to tip for your help :) https://...
user avatar
1 vote
0 answers
58 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
user avatar
1 vote
0 answers
29 views

What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?

I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
user avatar
  • 11
0 votes
1 answer
83 views

Deobfuscator and decompiler for .NET [closed]

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
user avatar
0 votes
1 answer
69 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...
user avatar
0 votes
0 answers
63 views

Harden C++ against decompilation

I have a small C++ program that contains a "secret" string that must be hard to find in the object code, e.g., #include <iostream> int main() { std::string a = "super-secret-...
user avatar
1 vote
1 answer
60 views

Custom IDA Decompilation Coloring

Is there a way to customize the coloring of IDA's decompiled code? IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
user avatar
  • 113
0 votes
0 answers
22 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
user avatar
0 votes
1 answer
62 views

How to make Ghidra don't brake mid token with triple dots?

So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ... Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
user avatar
  • 413
0 votes
0 answers
32 views

Philosophical and procedural question - Process for using x64 inline assembly in recovering source code

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
user avatar
  • 723
1 vote
2 answers
145 views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
user avatar
1 vote
1 answer
365 views

How to define "code" variable type in Ghidra

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
user avatar
1 vote
2 answers
65 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
user avatar
  • 49
0 votes
0 answers
102 views

Decompiling a Node.js application compiled with nexe

Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker. Judging by folders created in my user directory, multiple ...
user avatar
0 votes
0 answers
85 views

Injecting class into the JNIEnv in android jni

void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY); if (!handle) { printf("\nFailed to load library\n"); } void *offset = dlsym(handle, "...
user avatar
0 votes
0 answers
23 views

Missing definition of `FuncDefn`

So I used latest (10.0.4) Ghidra to decompile a x86 binary to c file and h header/ then I preprocessed it with the msvc cl compiler but in the result, while parsing it - turns out the typedefs for ...
user avatar
  • 413
1 vote
0 answers
55 views

identify the functions of stripped binaries

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
user avatar
1 vote
1 answer
88 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
user avatar
  • 113
2 votes
1 answer
101 views

Useless instructions in a compiled getter

This is the second time I see this kind of function today : .text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p .text:00000000000010B0 lea ...
user avatar
1 vote
1 answer
188 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
user avatar
  • 151
5 votes
1 answer
4k views

Decompile a NodeJS compiled program maybe by NEXE

I recently got idiotly scammed one of my discord account but kept the malware in case. Curious, I would love today to break into the executable to fetch any information about the scammer. I decompiled ...
user avatar
  • 51
0 votes
0 answers
75 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
user avatar
  • 146
1 vote
0 answers
34 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
user avatar
  • 146
1 vote
3 answers
325 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
user avatar
0 votes
0 answers
34 views

Decompiled VB 6.0 Application Call Statement

I decompiled a VB application using VB Decompiler pro. It contains the following call statements: Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98)) Can you please ...
user avatar
  • 1
1 vote
1 answer
86 views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
user avatar
1 vote
1 answer
581 views

How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)

Let's say there is a default base address for the application image on both IDA and Ghidra and it is equal to 140 000 000. If the function address is: 140 039 ea0 Does it mean that the offset from the ...
user avatar
  • 146
0 votes
0 answers
100 views

Procyon vs CFR for Java Decompiler

I'm trying to find the best Java class decompiler thats the most reliable. What's the difference between Procyon and CFR as far as decompiling the most classes sucessfully?
user avatar
2 votes
1 answer
272 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
user avatar
0 votes
2 answers
75 views

why does dalvik remove invocations during optimisation?

This is original smali code of a classes.dex method before installation .method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle; .registers 6 new-instance v0, Landroid/os/Bundle; ...
user avatar
  • 144
0 votes
1 answer
88 views

How to make sense of the pointer in reversed function call?

I have the code below, derived from the reversed function in the original application: gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50)); The create function ...
user avatar
  • 146
0 votes
0 answers
64 views

Baksmali services.odex from Android L (5.1, API22)

I'm trying to deodex a system file (/system/framework/arm/services.odex) as I need to modify it. I've tried every possible commands found online, but baksmali complains for "unsupported oat ...
user avatar
  • 101
0 votes
0 answers
153 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
user avatar
0 votes
1 answer
940 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
user avatar
  • 11
0 votes
0 answers
86 views

IDA: Function arguments detection

I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
user avatar
1 vote
0 answers
115 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
user avatar
0 votes
0 answers
314 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
user avatar
2 votes
2 answers
240 views

MIPS assembly to C code

I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
user avatar
2 votes
0 answers
79 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
user avatar
  • 73
2 votes
2 answers
294 views

Is decompilation significantly more limited when performed on handwritten assembly?

I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
user avatar
  • 125
2 votes
0 answers
117 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
user avatar
2 votes
0 answers
936 views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
user avatar
  • 21
0 votes
2 answers
189 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
user avatar
1 vote
0 answers
69 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
user avatar
  • 11
0 votes
0 answers
125 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
user avatar
1 vote
1 answer
99 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
user avatar

1
2 3 4 5
9