Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

0
votes
2answers
476 views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
3
votes
1answer
704 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
1answer
40 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
0
votes
1answer
300 views

IDA: NEC V850. Unable to identify anything

I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all. In order to do that, I select a V850 or V850E1 processor type and ...
-1
votes
1answer
102 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
-1
votes
1answer
257 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
-1
votes
1answer
203 views

Mapping a high level statement back in assembly dump

Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
4
votes
0answers
52 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
2
votes
0answers
143 views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
2
votes
0answers
107 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
2
votes
0answers
105 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
2
votes
0answers
80 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
2
votes
0answers
190 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
2
votes
0answers
215 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
1
vote
0answers
25 views

Is there any way to execute Hopper scripts from command line?

What should I do if I have a batch of binaries to decompile with Hopper? I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
1
vote
0answers
28 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
100 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
95 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
1
vote
0answers
397 views

Decompiling or modifying .exe file generated from .jar

I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
1
vote
0answers
49 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
0answers
93 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
1
vote
0answers
254 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
0answers
126 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
1
vote
0answers
65 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
1
vote
0answers
323 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
1
vote
0answers
285 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
1
vote
0answers
124 views

Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011

I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error "out of ...
1
vote
0answers
670 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
307 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
0
votes
0answers
35 views

Is it possible to recover the key to a decrypted file?

Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how? The file I want to recover the key from is a xml that looks like ...
0
votes
0answers
52 views

How to decompile these LUAs from the Bookworm Adventures games?

I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
0
votes
0answers
38 views

Taking a luac file and making a modification

I have a luac file for a program I use. I'd like to make a modification to this file to call a function from another luac script. My understanding of the way luac works is the first few bytes are the ...
0
votes
0answers
357 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...