Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

0
votes
3answers
759 views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
0
votes
1answer
140 views

How add String.equals to java bytecode (Krakatau)

I use Krakatau to edit java code. class test{ public boolean Func2(String text) { if(text=="aaaaaa") return true; return false; } } When I compile it I get this java bytecode ....
1
vote
1answer
161 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
1
vote
1answer
60 views

Object references representation in pseudocode

I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects. Let's say I'm looking at a line of code in a function called ...
1
vote
1answer
336 views

can't edit class file with recaf.0.9 without re-compile

I have this java code public class HelloWorld { public static void main(String[] args) { System.out.println("Hello World!"); } } I compile to class file, run it , and all fine. I ...
0
votes
1answer
96 views

AT&T - Does assembly code return whatever is in %eax by default?

I have the following AT&T assembly code: movl 12(%ebp),%eax cmpl %eax,8(%ebp) jle L7 movl 8(%ebp),%eax L7: leave I'm supposed to "transpose"(??) it to C code. I actually just have to ...
3
votes
3answers
158 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
1
vote
0answers
121 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
0
votes
1answer
150 views

Encrypted String? [closed]

(I made a topic but I was ask'd to re-made it) Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(...
1
vote
0answers
63 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
2
votes
1answer
3k views

How do Enigma, Themida and VMProtect compare to each other?

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
3
votes
1answer
314 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
0
votes
1answer
25k views

How to decompile an exe file? [duplicate]

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? How to decompile exe files ...
4
votes
1answer
128 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
2
votes
1answer
204 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
1
vote
0answers
287 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
0
votes
1answer
2k views

Download and Decompile an Ios app [closed]

I want to write an automatic process that downloads an ios app and decompile it? I couldn't find any source or method to download an ios app without using any Apple Device.
0
votes
0answers
270 views

Finding source files from dll

I've been given an Excel model who's back-end has been written in c++ and linked via a dll file. The project file directory has the following structure: model | | - excel-model.xlsb | - excel-...
0
votes
1answer
145 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
4
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
0
votes
1answer
138 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
1
vote
1answer
124 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
1answer
14k views

Can we decompile an .exe or .dll as %100? [closed]

Can we decompile a .exe or .dll file as 100%? Also sometimes seems some mistakes on somewhere (like mainfrm.cs) , how can we fix that? What is the best .NET decompiler? or What would you prefer? I ...
1
vote
2answers
144 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
1answer
65 views

Android Intercepts for log the Funtion Calls to javax

Im reversing an apk that uses a native library .so to make calls to some Java methods thru reflexion I know by analysing the app that exist the followings calls: import javax.crypto.Mac; import ...
1
vote
0answers
160 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
5
votes
4answers
779 views

Is there a tool capable of reconstructing structured code from arbitrary assembly code?

Essentially, I'm looking for a tool that could reconstruct pseudocode with conditional operators, loops, break/continue, etc. from assembly language code for an arbitrary CPU, given only a limited ...
0
votes
2answers
320 views

Smali vs Decompilation for malware detection in apk files

When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be ...
3
votes
1answer
627 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
-1
votes
1answer
234 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
1
vote
1answer
189 views

Unknown record type in Intel Hex file

I was working on a USB thumbwheel bootloader and reading in a number of records successfully, but around 2000 bytes it throws a check_sum error. I initially figured it had to be my code, but having ...
3
votes
3answers
4k views

How to decompile a C# .exe on macOS?

It this even possible? Are there any free tools?
-3
votes
1answer
221 views

IDA hexrays decompiler [closed]

Sometimes i see such lines. What do they mean, such syntax? (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4); int __fastcall sub_1(int a1, int a2) { int v2; // r4@1 int v3; // ...
1
vote
1answer
3k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
1
vote
1answer
1k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
4
votes
1answer
671 views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
1
vote
1answer
354 views

Encryption (AES-128) in automatic meters reading

I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters). Here's some introduction. I was trying to read a ...
0
votes
2answers
443 views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
1
vote
1answer
110 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
2answers
1k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
1
vote
2answers
267 views

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

For the following example, using x86 code in AT&T format: xor $0x20, (%eax) and $0x20, %ah or $0x20, %dh dec (%edi) dec %si dec %sp dec %bp My understanding: Line 1: takes value in %eax and ...
3
votes
2answers
399 views

Legal risks of retro engineering a 19 years old game

I am quite new to retro-reverse-engineering, and I am concerned about my current hobby. Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (...
2
votes
1answer
8k views

What to do with ILSpy error “This file does not contain a managed assembly”?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
0
votes
0answers
351 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
0
votes
1answer
1k views

IDA pseudo code decompilation

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding. Can someone please help me understand what is doing the code below: char __userpurge sub_41C140@<...
-2
votes
1answer
371 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
6
votes
1answer
539 views

Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?

I am learning reverse engineering, and would like a way to try out methods I'm learning. In web security, the way to try out and learn methods is a thing called DVWA. It is an insecure web app made ...
3
votes
1answer
1k views

Reverse engineering Lingo scripts .DCR/.CCT files

I was wondering if I could get some tips on reverse engineering .dcr/.cct files to get Lingo scripts. I know with recover-cct/recover-dir you can get all the assets etc. but you can't get Lingo ...