Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

6
votes
1answer
536 views

Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?

I am learning reverse engineering, and would like a way to try out methods I'm learning. In web security, the way to try out and learn methods is a thing called DVWA. It is an insecure web app made ...
3
votes
1answer
1k views

Reverse engineering Lingo scripts .DCR/.CCT files

I was wondering if I could get some tips on reverse engineering .dcr/.cct files to get Lingo scripts. I know with recover-cct/recover-dir you can get all the assets etc. but you can't get Lingo ...
0
votes
1answer
71 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
2
votes
2answers
8k views

Is it possible to convert matlab p-code to something viewable?

A simple disp("Hello World") gave me this : 7630 312e 3030 7630 302e 3030 0007 301c d3e7 7fb1 0000 0004 0000 002a 0000 0035 4c97 ee76 779b d4b9 3948 d7ea 798c 05ba c67a 2a56 c4de d7f9 7446 1d59 0472 ...
4
votes
1answer
265 views

move with sign extension in c code

I'm quite confused with the movsx(move with sign extension) I'm trying to convert assembly code to C. but stuck with movsx part. this is the code I got so far. #include <stdio.h> #...
1
vote
2answers
2k views

How to extract the OS files from this firmware bin file

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive: binwalk modem.bin DECIMAL HEX ...
2
votes
0answers
75 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
2
votes
1answer
452 views

Compile Hex-Rays code

I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it. So far I stopped on instructions like that: char (__usercall *__fastcall sub_947770(...
3
votes
1answer
85 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
0
votes
1answer
1k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
0
votes
0answers
91 views

How to decompile flash swz file? [duplicate]

I'm trying to reverse a fighting game to understand how the physics works. It's written in ActionScript and it's deployed with Adobe AIR. In the game directory, there's a bunch of swf files that ...
2
votes
2answers
2k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
0
votes
2answers
184 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
0answers
274 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
8
votes
1answer
2k views

Are the EU laws preventing reverse engineering of software products?

Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
2
votes
1answer
1k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...
3
votes
1answer
414 views

reverse engineering legal?

Few weeks ago, I started reverse engineering libraries and binaries from a commercial copyrighted product (game). And, I would like to post the code on an open source platform like Github. I've ...
0
votes
1answer
429 views

Converting assembly function to c

I have the following function in assembly, and i'm trying to convert it to c. the function accept 2 parameters, the first one is char* and the second is the int this is the assembly code: 71D3C400 ...
2
votes
1answer
144 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
1
vote
1answer
209 views

IDA Hex-Rays Generating Redundant Code

Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process. if ( v1 ) { v15....
4
votes
1answer
941 views

Wapiflapi reverse engeneering exercices

Right now I'm trying to solve r5 from here I've already tried to understand pseudo-code from Hooper function check_password { var_28 = arg0; if (strlen(var_28) != strlen("...
2
votes
2answers
713 views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
3
votes
1answer
1k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
4
votes
6answers
6k views

Are there any interactive decompilers besides HexRays?

Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or ...
0
votes
0answers
176 views

code coverage decompiler / reverse engineering

I'm trying to decompile some APK file in order to understand how this app employs certificate pinning. Since I have proof by testing that it does implement certificate pinning I tried the different ...
1
vote
1answer
4k views

Hex Rays - strange functions __ROL4__ and __ROR4__

What's purpose of functions ROL and ROR? For both of them, first arg is int, and second is byte I suppose that's bitwise shifts ]1s]2
0
votes
1answer
426 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
3
votes
1answer
555 views

Reverse engineering Android device framework

I'm trying to get to an Android device framework source to perform static analysis on it. I'm specifically looking at a Samsung Galaxy S6 device with Android 5.1.1. I downloaded the firmware image, ...
3
votes
2answers
5k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
1
vote
0answers
118 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
0
votes
1answer
222 views

Obtaining the argument text from a carg_t IDA Python object

I have a decompiled result from calling idaapi.decompile(). From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of ...
2
votes
1answer
608 views

Obtaining the Pseudocode of a function via a script

I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan). I did locate this documentation on using the decompiler in batch mode: ...
0
votes
0answers
273 views

Reversing a VB6/Winsock/ADO application

I used several Disassemblers/Debuggers/Decompilers to reverse a VB6 application which connects to a remote database using msado26.tlb and mswinsck.ocx I understood that the connection should be done ...
1
vote
1answer
1k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
0
votes
1answer
2k views

Issue decompiling c# method

I'm trying to decompile a c# dll and on a particular method I'm getting this result public IEnumerable<Guid> GetDbIdentifiers(int classId) { switch ((794999935 == 794999935) ? 1 : 0) { ...
1
vote
1answer
136 views

Does empty enumeration in C structure creates unnamed field?

I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header): struct S { enum {EN0, EN1}; int m1; } ; ...
0
votes
2answers
541 views

Ida Pro Decompiler Plugin producing way too few lines of code?

Im reverse engineering a Games Entity System from scratch. I found a function that initializes some sort of descriptor, it looks up a given property name in a huge array and initializes the structure ...
-2
votes
1answer
319 views

Help Coverting ASM to C [closed]

I need assistance decompiling the following from ASM to pseudo C. Code 1 ... mov edx, Var1 # Move Var1 to edx mov ecx, Var2 # Move Var2 to ecx mov eax, edx # Move EDX (Var1) to EAX ...
-1
votes
1answer
348 views

Reverse engineering of executable code

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the ...
1
vote
1answer
198 views

KeygenMe - My output has one wrong character

I'm trying to get into reverse engineering and am beginning with .NET, attempting various CrackMes and KeygenMes that I've found on the internet. Until now, I haven't really struggled but this latest ...
0
votes
3answers
296 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
0
votes
1answer
291 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
76 views

Trying to locate activator for function

I have been looking through a video games executable trying to find the values or variables in order to make a dev tool for real time editing. I have tried to trace the references back to maybe .float ...
2
votes
1answer
13k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
1
vote
1answer
551 views

How to display only the IR for your program code

I have a simple C program that is literally int main(void) { return 0; } When I convert this to assembly, gcc -S, it grows to around 10 lines. As expected. Then when I convert it into binary, ...
1
vote
0answers
479 views

Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE] [closed]

I am already aware of the question: 'Reverse Engineering program written in Python, compiled with “freeze”' I have Immunity Debugger and is this the pyc code and the structures? When I run the ...
0
votes
1answer
718 views

Global C++ classes/variables, strange initialisation

I apologise for the length of this post, though I have taken the time to make it as readable as I can and included my ideas and thinking where possible so this post might be useful to other readers ...
0
votes
2answers
3k views

How to decompile this assembly code? [closed]

How can I convert the following IDA Pro generated disassembly (assembly language) into a higher level language? ... mov edx, Var1 mov ecx, Var2 mov eax, edx imul ecx mov edx, eax imul edx, eax mov ...
1
vote
2answers
766 views

Find a string in an object file

I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/...