Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

5
votes
3answers
2k views

What exactly is binary disassembly and what it produces?

The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...
2
votes
1answer
190 views

How to do i fix it when IDA pro mislabels values as loc_

Some times the psuedo code generated by IDA is baffling v8 = (signed int)&loc_100010; //ida v8 = 0x100010; //actual code This is not so bad when it is just one value but sometimes the offset for ...
1
vote
1answer
352 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
0
votes
2answers
483 views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
1
vote
2answers
1k views

.NET: It's possible to recover original source code from compiled .exe when I have all the .vshost, .pdb and compiled files?

I have the compiled code with all .pdb, vshost and everything that is generated. I am already using DotPeek without too much hassle. Would like to know If I can retrieve the original code with all the ...
1
vote
3answers
490 views

Android- hiding private keys in .so file

I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
6
votes
1answer
247 views

How to tell if a particular .NET assembly was written in C# or F#?

The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code. Why does decompiling an F# assembly produce C# ...
1
vote
0answers
256 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
5answers
260 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
1
vote
1answer
109 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
2
votes
1answer
206 views

Macho - remove a LOAD COMMAND from iOS binary

I want to remove a LOAD_COMMAND from my iOS app binary. I tried jtool: jtool -rC 3 my_app_binary This worked when I was removing a dynamic library. But it generated an empty binary file and the ...
0
votes
3answers
889 views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
0
votes
1answer
160 views

How add String.equals to java bytecode (Krakatau)

I use Krakatau to edit java code. class test{ public boolean Func2(String text) { if(text=="aaaaaa") return true; return false; } } When I compile it I get this java bytecode ....
1
vote
1answer
178 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
1
vote
1answer
62 views

Object references representation in pseudocode

I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects. Let's say I'm looking at a line of code in a function called ...
1
vote
1answer
383 views

can't edit class file with recaf.0.9 without re-compile

I have this java code public class HelloWorld { public static void main(String[] args) { System.out.println("Hello World!"); } } I compile to class file, run it , and all fine. I ...
0
votes
1answer
116 views

AT&T - Does assembly code return whatever is in %eax by default?

I have the following AT&T assembly code: movl 12(%ebp),%eax cmpl %eax,8(%ebp) jle L7 movl 8(%ebp),%eax L7: leave I'm supposed to "transpose"(??) it to C code. I actually just have to ...
4
votes
3answers
176 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
1
vote
0answers
127 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
0
votes
1answer
162 views

Encrypted String? [closed]

(I made a topic but I was ask'd to re-made it) Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(...
1
vote
0answers
65 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
2
votes
1answer
3k views

How do Enigma, Themida and VMProtect compare to each other?

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
3
votes
1answer
345 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
0
votes
1answer
28k views

How to decompile an exe file? [duplicate]

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? How to decompile exe files ...
4
votes
1answer
137 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
2
votes
1answer
217 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
1
vote
0answers
323 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
0
votes
1answer
2k views

Download and Decompile an Ios app [closed]

I want to write an automatic process that downloads an ios app and decompile it? I couldn't find any source or method to download an ios app without using any Apple Device.
0
votes
1answer
147 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
5
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
0
votes
1answer
144 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
1
vote
1answer
130 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
1answer
17k views

Can we decompile an .exe or .dll as %100? [closed]

Can we decompile a .exe or .dll file as 100%? Also sometimes seems some mistakes on somewhere (like mainfrm.cs) , how can we fix that? What is the best .NET decompiler? or What would you prefer? I ...
1
vote
2answers
159 views

Find out how a program is reading a file

I'd like to manually "pull out" information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a "plaintext" version of them. However, ...
1
vote
1answer
74 views

Android Intercepts for log the Funtion Calls to javax

Im reversing an apk that uses a native library .so to make calls to some Java methods thru reflexion I know by analysing the app that exist the followings calls: import javax.crypto.Mac; import ...
2
votes
0answers
192 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
5
votes
4answers
892 views

Is there a tool capable of reconstructing structured code from arbitrary assembly code?

Essentially, I'm looking for a tool that could reconstruct pseudocode with conditional operators, loops, break/continue, etc. from assembly language code for an arbitrary CPU, given only a limited ...
0
votes
2answers
339 views

Smali vs Decompilation for malware detection in apk files

When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be ...
3
votes
1answer
709 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
-1
votes
1answer
258 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
1
vote
1answer
204 views

Unknown record type in Intel Hex file

I was working on a USB thumbwheel bootloader and reading in a number of records successfully, but around 2000 bytes it throws a check_sum error. I initially figured it had to be my code, but having ...
4
votes
3answers
4k views

How to decompile a C# .exe on macOS?

It this even possible? Are there any free tools?
-3
votes
1answer
240 views

IDA hexrays decompiler [closed]

Sometimes i see such lines. What do they mean, such syntax? (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4); int __fastcall sub_1(int a1, int a2) { int v2; // r4@1 int v3; // ...
1
vote
1answer
3k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
1
vote
1answer
1k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
4
votes
1answer
716 views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
1
vote
1answer
381 views

Encryption (AES-128) in automatic meters reading

I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters). Here's some introduction. I was trying to read a ...
0
votes
2answers
486 views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...