Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
0
votes
1answer
23 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0answers
26 views

Decompiled VB 6.0 Application Call Statement

I decompiled a VB application using VB Decompiler pro. It contains the following call statements: Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98)) Can you please ...
1
vote
1answer
156 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
1
vote
1answer
16 views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
1
vote
1answer
58 views

How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)

Let's say there is a default base address for the application image on both IDA and Ghidra and it is equal to 140 000 000. If the function address is: 140 039 ea0 Does it mean that the offset from the ...
0
votes
0answers
23 views

Procyon vs CFR for Java Decompiler

I'm trying to find the best Java class decompiler thats the most reliable. What's the difference between Procyon and CFR as far as decompiling the most classes sucessfully?
2
votes
1answer
88 views

Can obfuscation be applied on certain parts?

I am newbie to this field. I am still learning from your wonderful contributions, help and guidance. I have had an app that i want to study in-depth. How the the it is constructed? What components ...
0
votes
1answer
46 views

why does dalvik remove invocations during optimisation?

This is original smali code of a classes.dex method before installation .method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle; .registers 6 new-instance v0, Landroid/os/Bundle; ...
0
votes
1answer
55 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
2
votes
1answer
760 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
0
votes
1answer
109 views

MIPS assembly to C code

I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
0
votes
1answer
206 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
0
votes
1answer
142 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
0
votes
1answer
83 views

How to make sense of the pointer in reversed function call?

I have the code below, derived from the reversed function in the original application: gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50)); The create function ...
0
votes
2answers
73 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
0
votes
0answers
26 views

Baksmali services.odex from Android L (5.1, API22)

I'm trying to deodex a system file (/system/framework/arm/services.odex) as I need to modify it. I've tried every possible commands found online, but baksmali complains for "unsupported oat ...
0
votes
0answers
52 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
75 views

IDA: Function arguments detection

I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
2
votes
1answer
781 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
1
vote
0answers
54 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
-1
votes
1answer
498 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
0
votes
0answers
71 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
4
votes
0answers
255 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
62
votes
7answers
123k views

Possibilities for reverse engineering an ipa file to its source

I browsed a lot, but can't find any resources for reverse engineering an ipa file (iPhone application). Is there any method to reverse engineer an ipa file to its source? I've tried to rename it to ...
0
votes
1answer
108 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
1
vote
1answer
484 views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
2
votes
2answers
270 views

Is decompilation significantly more limited when performed on handwritten assembly?

I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
2
votes
0answers
72 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
2
votes
0answers
73 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
1
vote
1answer
3k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
0
votes
0answers
44 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
33
votes
5answers
26k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
1
vote
1answer
78 views

Converting a data address offset to the equivalent struct in a C++ module

I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so: v32 = ( v3 + ...
24
votes
7answers
76k views

Decompiling .pyc files

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files? Everything I've found seems to break...
2
votes
0answers
297 views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
0
votes
2answers
136 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
2
votes
0answers
5k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
1
vote
0answers
51 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
1
vote
1answer
78 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
0
votes
1answer
226 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
0
votes
0answers
116 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
1
vote
1answer
242 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
3
votes
1answer
560 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
0
votes
0answers
58 views

Change PHP Function behaviour on a encrypted file

I have a PHP file that is encrypted with Ioncube. Searching on the internet I found one guy which has decoded it, but when I run the decoded file, the code behavior changes so I can't replace the ...
2
votes
1answer
3k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
8
votes
3answers
12k views

How to decompile a C# .exe on macOS?

It this even possible? Are there any free tools?
3
votes
1answer
114 views

Specifying the register value which is constant for all the functions

In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables. e.g. register r13 is set to 0x40000000 which ...
0
votes
1answer
65 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
0
votes
1answer
172 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
0
votes
2answers
1k views

Modifying UnityPlayer.dll with dnSpy or other

I've been looking into reverse engineering a game developped with Unity 2017.4.10, to find a way to get a freely controlled camera. I found the values that interest me in Managed/Assembly-CSharp.dll ...

1
2 3 4 5
9