Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

1
vote
1answer
94 views

Decompiling, changing, compiling and using a program which can damage my computer

I need to change a program which updates firmware on a computer. I want to decompile it, make changes in it, then compile it and use it for updating my computer's firmware. I wonder if it is possible ...
4
votes
2answers
3k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
1answer
962 views

Decompiling a windows 3.1, VisualBasic 3 exe. Do I need to decompile dll too? How?

New to decompiling, and code generally. Trying to decompile a windows 3.1 game (text adventure), so I can build it up again. Because at the moment it doesn't work (even on windows 3.1). I decompiled ...
1
vote
1answer
3k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
-1
votes
1answer
194 views

Mapping a high level statement back in assembly dump

Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
4
votes
1answer
899 views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
1
vote
0answers
123 views

Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011

I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error "out of ...
0
votes
1answer
139 views

Does anybody know which tools allow to get (pseudo) code from a Moscow ML executable?

I've decompiled Win32 executable that is the result of compilation of a program written in Moscow ML language. The resulting listing contains standard C main function that contains the call to ...
-1
votes
1answer
228 views

Reversing a function, methodology

Which are the methods or which are the steps for from a asm disassembled function code passing/converting it to 'C/C++' or other language and tell what happens.
1
vote
1answer
1k views

Assistance in Decrypting Lua script that is obfuscated with Base64 > SSL

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? Basically they are encoded with Base64 then SSL, but I have no idea how to ...
-4
votes
1answer
2k views

Is it possible to decompile the password protected rar file? [closed]

I'm trying to crack winrar's password using some methods as explained below. Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years. But, if we ...
1
vote
1answer
160 views

Getting Encryption Method When I Know Encrypted File Name & Original File Name

I'm busy trying to decrypt some game data. All the encrypted filenames are hexadecimal strings with the same length e.g. 1790C6E445C7E38EFCD5B3042F9B4443. I've figured out that a few of the files ...
3
votes
1answer
5k views

What is the meaning of *(_DWORD *)

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. for ( i = 0; i < 6; ++i ) { v7 = (int)&val_253; for ( k = 1; k < ...
1
vote
1answer
106 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
1
vote
0answers
656 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
1answer
98 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
1
vote
1answer
584 views

Help with analysis from IDA Pro Hex-Rays dump

I'm trying to reverse-engineer a file format, and I got a buddy of mine (who works in the security field) to decompile the program via Hex-Rays and give me the resulting .C file. I've spent the past ...
-3
votes
1answer
257 views

What are the risks of running a decompiler? [closed]

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb. I've searched and ...
2
votes
2answers
4k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
7
votes
1answer
676 views

IL for decompiler to human-readable format

After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example push ebp mov ebp, esp sub esp, 10h mov eax, ...
2
votes
1answer
3k views

Stronger than Themida?

I am new to reverse engineering and file protections. I have made a trading algorithm for Tradestation that I have put into a C++ DLL instead of having the source laying around, and I want to protect ...
0
votes
1answer
94 views

Understanding pseudocode containing a math operation in a variable assignment [closed]

So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. The code in particular iterates through every byte of the encrypted file, ...
0
votes
1answer
118 views

Windows PKZIP encryption / compression calls might be altering password?

I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file... basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,...
2
votes
1answer
180 views

How to locate the code used for encryption

I've been playing around with recording packets being sent to and from applications on my pc. Logically any program that sends or receives packets must have the encryption scheme used. So I'd like to ...
0
votes
1answer
3k views

How to decompile python [duplicate]

How can I decompile python 3.3 files ?? Can you please suggest me a tool for linux ubuntu 14.10 in specific note easy decompiler didn't work for me :(
4
votes
1answer
747 views

Coalesce Enums in IDA?

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums? For instance, I have the following enums, HTTP_QUERY_CONNECTION has the value 23 and ...
2
votes
1answer
9k views

what's the function of LODWORD and HIDWORD?

I'm trying to figure out what does this piece of code exactly: LODWORD(fMax) = *(_DWORD *)v12; HIDWORD(fMax) = v13; I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
8
votes
4answers
11k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
-1
votes
2answers
30k views

EXE to C source code decompiler [duplicate]

Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
8
votes
1answer
980 views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
4
votes
1answer
797 views

Protect a key from being recovered by decompilation

I work in a game editor that develop an online game. In our endless struggle against bots (that have negative impacts on server performances, game economy, game experience, ...), one of ours weapons ...
2
votes
0answers
54 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
2
votes
1answer
132 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
8
votes
2answers
6k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
2
votes
3answers
757 views

How to get resource in swf file?

I use this site http://www.showmycode.com/ to decompile the swf below http://kwcdn.000dn.com/swfs/8b/23440heisesm/bg.swf But the code only shows the link for a video but I can not get the image in ...
1
vote
2answers
855 views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
10
votes
4answers
13k views

AirPlay Mirroring decryption (FairPlay)

I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
0
votes
1answer
1k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
1
vote
0answers
306 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
1answer
1k views

R.java to xml file

How does R.java work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used apktool to extract ...
1
vote
1answer
1k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
2
votes
1answer
394 views

File Type - VCDIFF binary extract

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and ...
1
vote
1answer
78 views

Signed/unsigned representation of ints in decompiled code in Hopper

Hopper allows you to change the representation of numbers in the disassembly window so that: 0000be84 str r3, [r11, #0xfffffff0] becomes: 0000be84 str r3, [r11, #-0x10]...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
0
votes
1answer
142 views

COM file starting point

I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the ...
6
votes
2answers
5k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
2
votes
1answer
2k views

Deobfuscating IDA Pseudocode

I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro. ...
4
votes
6answers
5k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
2
votes
2answers
7k views

Legality of Decompilation [duplicate]

How "legal" is it to read and edit .exe files, .dll files, and other compiled source files? Decompilation is taking the compiled code of a program, often minified and obfuscated, and trying to get the ...