Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
298
questions
0
votes
0answers
2 views
Deconstructing Unity games
Note: I only want to edit/mod the games not trying to steal things etc.
I'm trying to deconstruct some Unity games from both PC and Android platforms and already extracted assets with uTinyRipper ...
0
votes
0answers
21 views
Can I perform small mod on Apple Iphone app without access to original source code?
I purchase a hardware device called 'XBOX' from Chinese factory.
They provide a fully functional app that is called 'XBOXAPP' and is available from App Store.
The XBOXAPP is designed to perform ...
1
vote
2answers
60 views
Can I decompile a file if I have a compiler? [on hold]
Is it possible to reverse the compiled code using a compiler?
I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.
...
0
votes
1answer
50 views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
0
votes
1answer
75 views
How to decrypt a file who encryption and key is unknown?
Here is the file that I am trying to findout a way to decrypt.
settings.ini
This file is from the settings of the MetaTrader 5. The same is the name of the application.
Kindly suggest a better way so ...
0
votes
1answer
105 views
How do I reverse engineer a game using dnSpy?
I've been reading some about reverse engineering and decided to try to learn as I go, which has proven somewhat difficult. Sorry about the generic title, I'll try and give enough info so it can be ...
2
votes
1answer
161 views
Decompiler attack
I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.:
So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
3
votes
1answer
137 views
concat22 in ghidra decompiler
Some portion of code I am analyzing gets decompiled as below in ghidra:
if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) &&
(*(uint *)((int)puVar9 + 6) ==
(CONCAT22(...
0
votes
0answers
76 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
37 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
0
votes
2answers
113 views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
2
votes
2answers
113 views
Java reverse engineering tool [closed]
I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it.
I've tried PNF's JEB which is really perfect but it's only for Android stuff....
2
votes
0answers
107 views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
1
vote
0answers
31 views
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
2answers
76 views
Strings weirdly split in binary
Recently I have come across a few parts in a binary that looked odd to me, and I wanted to ask if this is something common compilers do, and if there is a way to undo it.
(The binary is from a raw ...
1
vote
0answers
47 views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
1
vote
0answers
40 views
(Help) APK Decomplied unreadable .pngs
I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
0
votes
1answer
78 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
68 views
Confusion about LEA and why it means what it does in this context
I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example.
The first part of it is fairly straightfoward-
7C921A39 MOV EDI,EDI
7C921A3B PUSH EBP
...
1
vote
0answers
196 views
Decompile large function in IDA
I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
2
votes
1answer
140 views
Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?
I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
1
vote
0answers
63 views
Calling functions of a shared object (.so) extracted from an APK
Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
0
votes
1answer
53 views
Search string in all binary pesudo-code
How can I search pesudo code string in all functions in binary with Ida??
Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)
I want to search for example where ...
1
vote
1answer
71 views
IDA Copy structure from one database instance to another
This question sounds rather simple, but I can't seem to find any option for this.
I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
1
vote
0answers
102 views
Can you change the architecture in Ghidra after importing?
I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
1answer
119 views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with virtual machine : the problem is it's not opcode anymore it's bytecode which I don't have any idea about because it's a private virtual ...
1
vote
0answers
65 views
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?
...
2
votes
0answers
131 views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
0
votes
0answers
54 views
(Help)Apk Decomplied unreadable files
I'm developing an android-based game for my school project.
I chose an .apk to reference the visual parts.
I've decompiled the .apk file I've specified. I can't view the image files I need.
files ...
3
votes
1answer
1k views
How do I import function signatures to Ghidra?
I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
0
votes
1answer
105 views
Is it possible to recover the key to a decrypted file?
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how?
The file I want to recover the key from is a xml that looks like ...
4
votes
1answer
576 views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
1
vote
1answer
230 views
De-obfuscating code ran through JScrambler 3x via Eval() functions
I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
66 views
deobfuscating/decompiling extremely complicated javascript [closed]
I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this
U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
0
votes
1answer
192 views
Unable to decompile C Code
Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
5
votes
1answer
1k views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
1answer
145 views
Decryption loops
I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:
for ( i = 0; i < n; ++i )
{
v22 = *((_BYTE *)sub_5657D89B + i);
v0 = v22 ^ 0x90;
v1 = strlen(&...
-1
votes
1answer
137 views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
1
vote
0answers
66 views
Is there any way to execute Hopper scripts from command line?
What should I do if I have a batch of binaries to decompile with Hopper?
I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
0
votes
1answer
144 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
1
vote
0answers
124 views
How to decompile these LUAs from the Bookworm Adventures games?
I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
0
votes
0answers
143 views
Taking a luac file and making a modification
I have a luac file for a program I use. I'd like to make a modification to this file to call a function from another luac script. My understanding of the way luac works is the first few bytes are the ...
0
votes
1answer
79 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
1answer
875 views
Impossible to execute a program with radare2 : TO DO continue
I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
2
votes
0answers
225 views
Reconstruct InnoSetup file with existing CompiledCode.bin
Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option.
Basically ...
1
vote
1answer
618 views
How can I make IDA understand this switch statement with a signed jump table?
I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:
int main() {
int a = 0;
for (int i = 0; i < 5; i++) {
switch (i) {
case 0:
a = 1;
break;
...
4
votes
1answer
324 views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
1
vote
0answers
29 views
How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?
When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
185 views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
0
votes
1answer
155 views
Multiple decompilation failure with ntoskrnl
IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that:
I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
