Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
1k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
4
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
2
votes
0answers
73 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
2
votes
0answers
497 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
2
votes
0answers
170 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
1answer
423 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
2
votes
0answers
386 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
2
votes
0answers
185 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
2
votes
0answers
112 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
2
votes
0answers
2k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
2
votes
0answers
319 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
2
votes
0answers
221 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
1
vote
0answers
42 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
1
vote
0answers
69 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
1
vote
0answers
133 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
1
vote
0answers
55 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
1
vote
0answers
84 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
1
vote
0answers
42 views

Finding PEM passphrase that may be in an executable?

I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
1
vote
0answers
54 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
0answers
64 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
0answers
49 views

(Help) APK Decomplied unreadable .pngs

I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
1
vote
1answer
937 views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
1
vote
0answers
94 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
1
vote
0answers
120 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
1
vote
0answers
104 views

Is there any way to execute Hopper scripts from command line?

What should I do if I have a batch of binaries to decompile with Hopper? I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
1
vote
0answers
187 views

How to decompile these LUAs from the Bookworm Adventures games?

I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
1
vote
0answers
30 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
1
vote
0answers
300 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
200 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
1
vote
0answers
486 views

Decompiling or modifying .exe file generated from .jar

I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
1
vote
0answers
86 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
0answers
190 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
1
vote
0answers
374 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
0answers
169 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
1
vote
0answers
78 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
1
vote
0answers
479 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
1
vote
0answers
357 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
1
vote
0answers
143 views

Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011

I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error "out of ...
1
vote
0answers
792 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
0answers
328 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
0
votes
0answers
102 views

What are the known techniques used by wrappers and obfuscators to protect against decompiling?

I am NOT looking to make my application 99% safe, nor my goal is to prevent a a determined reverse-engineer to disassemble it, but simply is to protect my source code from lambda user with little ...
0
votes
0answers
121 views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
0answers
50 views

Force gcc to use more complex instructions

I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...
0
votes
0answers
30 views

inspecting c-sky elf application

I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver the receiver is based on c-sky v1 architecture searching forums , I managed to get the firmware ...
0
votes
0answers
111 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
0answers
84 views

What are good tips to reverse engineering code with no variable name information and loss of the debug information?

I am a exploiter for roblox which mean that I execute scripts via an external program called an exploit on running roblox games. To make script for my exploits, I have to use debugging library and ...
0
votes
0answers
69 views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
62 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...