Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

1
vote
1answer
116 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
2answers
1k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
1
vote
2answers
272 views

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

For the following example, using x86 code in AT&T format: xor $0x20, (%eax) and $0x20, %ah or $0x20, %dh dec (%edi) dec %si dec %sp dec %bp My understanding: Line 1: takes value in %eax and ...
3
votes
2answers
413 views

Legal risks of retro engineering a 19 years old game

I am quite new to retro-reverse-engineering, and I am concerned about my current hobby. Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (...
2
votes
1answer
9k views

What to do with ILSpy error “This file does not contain a managed assembly”?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
0
votes
0answers
357 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
0
votes
1answer
1k views

IDA pseudo code decompilation

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding. Can someone please help me understand what is doing the code below: char __userpurge sub_41C140@<...
-2
votes
1answer
388 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
6
votes
1answer
556 views

Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?

I am learning reverse engineering, and would like a way to try out methods I'm learning. In web security, the way to try out and learn methods is a thing called DVWA. It is an insecure web app made ...
3
votes
1answer
1k views

Reverse engineering Lingo scripts .DCR/.CCT files

I was wondering if I could get some tips on reverse engineering .dcr/.cct files to get Lingo scripts. I know with recover-cct/recover-dir you can get all the assets etc. but you can't get Lingo ...
0
votes
1answer
79 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
2
votes
2answers
9k views

Is it possible to convert matlab p-code to something viewable?

A simple disp("Hello World") gave me this : 7630 312e 3030 7630 302e 3030 0007 301c d3e7 7fb1 0000 0004 0000 002a 0000 0035 4c97 ee76 779b d4b9 3948 d7ea 798c 05ba c67a 2a56 c4de d7f9 7446 1d59 0472 ...
4
votes
1answer
289 views

move with sign extension in c code

I'm quite confused with the movsx(move with sign extension) I'm trying to convert assembly code to C. but stuck with movsx part. this is the code I got so far. #include <stdio.h> #...
1
vote
2answers
2k views

How to extract the OS files from this firmware bin file

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive: binwalk modem.bin DECIMAL HEX ...
2
votes
0answers
78 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
2
votes
1answer
480 views

Compile Hex-Rays code

I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it. So far I stopped on instructions like that: char (__usercall *__fastcall sub_947770(...
3
votes
1answer
85 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
0
votes
1answer
1k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
2
votes
2answers
2k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
0
votes
2answers
204 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
0answers
285 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
9
votes
1answer
3k views

Are the EU laws preventing reverse engineering of software products?

Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
2
votes
1answer
1k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...
3
votes
1answer
436 views

reverse engineering legal?

Few weeks ago, I started reverse engineering libraries and binaries from a commercial copyrighted product (game). And, I would like to post the code on an open source platform like Github. I've ...
0
votes
1answer
448 views

Converting assembly function to c

I have the following function in assembly, and i'm trying to convert it to c. the function accept 2 parameters, the first one is char* and the second is the int this is the assembly code: 71D3C400 ...
3
votes
1answer
145 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
1
vote
1answer
217 views

IDA Hex-Rays Generating Redundant Code

Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process. if ( v1 ) { v15....
4
votes
1answer
1k views

Wapiflapi reverse engeneering exercices

Right now I'm trying to solve r5 from here I've already tried to understand pseudo-code from Hooper function check_password { var_28 = arg0; if (strlen(var_28) != strlen("...
2
votes
2answers
761 views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
3
votes
1answer
1k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
4
votes
6answers
7k views

Are there any interactive decompilers besides HexRays?

Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or ...
1
vote
1answer
4k views

Hex Rays - strange functions __ROL4__ and __ROR4__

What's purpose of functions ROL and ROR? For both of them, first arg is int, and second is byte I suppose that's bitwise shifts ]1s]2
0
votes
1answer
472 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
3
votes
1answer
573 views

Reverse engineering Android device framework

I'm trying to get to an Android device framework source to perform static analysis on it. I'm specifically looking at a Samsung Galaxy S6 device with Android 5.1.1. I downloaded the firmware image, ...
3
votes
2answers
5k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
1
vote
0answers
121 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
0
votes
1answer
235 views

Obtaining the argument text from a carg_t IDA Python object

I have a decompiled result from calling idaapi.decompile(). From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of ...
2
votes
1answer
635 views

Obtaining the Pseudocode of a function via a script

I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan). I did locate this documentation on using the decompiler in batch mode: ...
1
vote
1answer
2k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
0
votes
1answer
2k views

Issue decompiling c# method

I'm trying to decompile a c# dll and on a particular method I'm getting this result public IEnumerable<Guid> GetDbIdentifiers(int classId) { switch ((794999935 == 794999935) ? 1 : 0) { ...
1
vote
1answer
143 views

Does empty enumeration in C structure creates unnamed field?

I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header): struct S { enum {EN0, EN1}; int m1; } ; ...
0
votes
2answers
564 views

Ida Pro Decompiler Plugin producing way too few lines of code?

Im reverse engineering a Games Entity System from scratch. I found a function that initializes some sort of descriptor, it looks up a given property name in a huge array and initializes the structure ...
-2
votes
1answer
327 views

Help Coverting ASM to C [closed]

I need assistance decompiling the following from ASM to pseudo C. Code 1 ... mov edx, Var1 # Move Var1 to edx mov ecx, Var2 # Move Var2 to ecx mov eax, edx # Move EDX (Var1) to EAX ...
-1
votes
1answer
387 views

Reverse engineering of executable code

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the ...
1
vote
1answer
199 views

KeygenMe - My output has one wrong character

I'm trying to get into reverse engineering and am beginning with .NET, attempting various CrackMes and KeygenMes that I've found on the internet. Until now, I haven't really struggled but this latest ...
0
votes
3answers
302 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
0
votes
1answer
305 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
77 views

Trying to locate activator for function

I have been looking through a video games executable trying to find the values or variables in order to make a dev tool for real time editing. I have tried to trace the references back to maybe .float ...
2
votes
1answer
13k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...