Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
0 votes
0 answers
42 views

How to exclude "Process Monitor" from Themida's list of monitoring programs

Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags? I want to exclude Sysinternals "Process Monitor&...
Coldblackice's user avatar
0 votes
1 answer
102 views

i need software to decode this subtitle xml file, anyone know what it encodes with?

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt? Subtitle link xml
Đức Nguyễn's user avatar
1 vote
0 answers
132 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar
0 votes
1 answer
97 views

Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing

Goal: Trying to reverse encrypter to decrypter that successfully decrypts. This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
Brandon Gregory's user avatar
-3 votes
1 answer
553 views

Is it possible to decompile ex5? What are some hints in how one would do so?

I am creating an expert advisor. I am wondering how people can decompile the ex5 to mq5 for meta trader. Does anyone have any insight on this?
The Coder's user avatar
0 votes
1 answer
89 views

ELF - Why does objdump provide a wrong byte value in the .got?

I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert. $ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test test: file format ...
chilliefiber's user avatar
2 votes
1 answer
110 views

How to define a 28-bit integer in Ghidra

I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra. I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
Vincent Guttmann's user avatar
0 votes
1 answer
1k views

What are some methods to reverse a ex5 file for metatrader 5?

What are some methods to reverse a ex5 file, for metatrader 5? I would like to understand how people crack ex5 files and make them for use. Any ideas of reverse engineering tools for this scenario?
The Coder's user avatar
2 votes
0 answers
51 views

How to find where an instance variable of some object is set to some concrete value?

I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
Thorsten Schöning's user avatar
2 votes
1 answer
170 views

How to map a decompiled c program back into original source code

I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update). So is ...
user3368585's user avatar
1 vote
0 answers
70 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
2 votes
0 answers
64 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
5 votes
1 answer
117 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
Cesar Canassa's user avatar
2 votes
1 answer
86 views

Stuck decompiling ARM64 function

I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY. As far as I can tell, it reads the raw sensor ...
duckblaster's user avatar
3 votes
1 answer
168 views

IDA Decompiler generates wrong output on array of structures!

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is: MOV i, i,LSL#4 LDR R4, =arr_of_struct ADD i, i, R4 LDR ...
E.A's user avatar
  • 171
5 votes
2 answers
573 views

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines? MOV R1, #100 -> MOV R1, #(5 * 20) LDR R8, =var | ...
E.A's user avatar
  • 171
4 votes
3 answers
366 views

Help disassembling a simple 16-bit NE function

I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required. I would assume ...
jttri777's user avatar
  • 165
2 votes
0 answers
150 views

Why i cant see source code from this dll

// PE file does not contain any managed metadata.
Zeko It's user avatar
  • 21
1 vote
0 answers
34 views

Santander US - app

I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. ...
Guilherme Klesse de Miranda's user avatar
2 votes
0 answers
439 views

Decompiling an APK of Unity framework with IL2CPP

Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed? I tried stuff like https://github.com/Perfare/...
forvev's user avatar
  • 21
4 votes
1 answer
2k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
3 votes
1 answer
81 views

Double constructor when reversing Unity game

When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set. Here is an example: ...
Irbis77's user avatar
  • 326
3 votes
1 answer
115 views

Linux Kernel for embedded platform - Available Sources but no configuration

I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
KiralyCraft's user avatar
2 votes
0 answers
114 views

I trying rewrite asm to c++ [closed]

This code generates an API key. I use it in an android app as .so file, but I need to rewrite it to java from c++. How do I translate? push rbp push r15 push r14 push r13 push r12 push ...
Master's user avatar
  • 21
3 votes
1 answer
177 views

What tricks can I use to manually decompile a set of instructions

ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are eax ebx ecx edx esi length of user input (min length is 3) 0 ...
Mr. Kelsey's user avatar
4 votes
1 answer
279 views

IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text

Recently I got a program that has two colors of .text segment, one is black and the other is brown: While the flow chart and the decompiler work well on black part, they are both disabled on the ...
user239216's user avatar
2 votes
0 answers
33 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
2 votes
0 answers
38 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
119 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
Mr Xero's user avatar
  • 21
2 votes
1 answer
78 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
Anis LOUNIS aka AnixPasBesoin's user avatar
2 votes
0 answers
342 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
omicronns's user avatar
  • 121
1 vote
0 answers
127 views

Extracting contents of unknown file format

I would love some help on working with this file format. I have this archived file from this abandonware game that I like to mess around with, and I have tried all sorts to try and expand it to ...
Harry's user avatar
  • 19
1 vote
1 answer
274 views

Are there websites for reverse engineering challenges similar the programming challenges? [duplicate]

As a developer, reverse engineering has always fascinated me. It amazes me to see what some people can figure out just from a dump of assembly code, and I would like to become better at doing the same....
Entangled Superposition's user avatar
1 vote
2 answers
977 views

Decompiling and Recompiling APK leads to crash using Apktool

Decompiling and recompiling an apk causes it to crash. My goal is simply to insert a method into smali code that prints a stacktrace, but even decompiling and recompiling with no changes causes the ...
Sid's user avatar
  • 121
2 votes
0 answers
272 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb's user avatar
0 votes
2 answers
194 views

How to Convert given set of Assembly-Level Instructions to High-Level Language Code?

As I am working on malware analysis, I got stuck in a place where I have to change the given set of assembly-level instructions to high-level code. Example: Assembly Level Code mov ebp, esp ...
okokok hack's user avatar
1 vote
0 answers
101 views

IDA Pro maps wrong variable for offset

I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
mastermind's user avatar
3 votes
1 answer
348 views

Reverse-engineering a 90s CNC machine (FORTH like) firmware

Here's an undertaking I'm currently in, and would absolutely love someone to assist more directly. I'll list the subjects that I would greatly appreciate more knowledge within. Know anything about one ...
Sasha Carlson's user avatar
2 votes
1 answer
2k views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6. I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
Cave Johnson123's user avatar
1 vote
1 answer
425 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
markzzz's user avatar
  • 113
1 vote
1 answer
264 views

Decrypting .toc file

So I have a few files from a game on my pc, most of which are .toc files I believe this means they are a "table of contents" as the ending suggests, but my attempts to read them have been ...
Echology's user avatar
2 votes
0 answers
174 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
rec's user avatar
  • 455
2 votes
1 answer
144 views

Decompilation output modification in IDA Pro

I am trying to modify cfunc AST from If (a1 && some_func_ptr) { some_func_ptr(); } To if (a1) { some_func_ptr(); } But I constantly get INTERR 50683 error. I tried new_item = idaapi....
mizari's user avatar
  • 81
0 votes
1 answer
155 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
1 vote
0 answers
960 views

Ida Pro can't decompile big function

I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error : The graph is too big (more than 1000 nodes) to be displayed on the screen. Switching to text mode. (you ...
vtable's user avatar
  • 183
0 votes
1 answer
457 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
Aeonitis's user avatar
  • 101
1 vote
1 answer
187 views

Python or C for a Qt application and security against reverse engineering

I actually have two choices : C or Python to create my application. On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
sramazoth's user avatar
  • 113
3 votes
0 answers
254 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
lethal-guitar's user avatar
3 votes
1 answer
768 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
vincent's user avatar
  • 131
1 vote
1 answer
65 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
rec's user avatar
  • 455

1
2 3 4 5
10