Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
571
questions
71
votes
7
answers
141k
views
What are the possibilities for reverse engineering an IPA file to its source?
I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
- 1,097
63
votes
7
answers
133k
views
What is a good Java decompiler and deobfuscator?
I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
43
votes
3
answers
28k
views
Unpacking binaries in a generic way
I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
- 3,208
42
votes
1
answer
93k
views
Decompiling iPhone App
I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
- 429
41
votes
8
answers
81k
views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
- 907
37
votes
3
answers
32k
views
How do I figure out what is burned on an Arduino ROM?
I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board.
How do I extract the code from the board?
How do I figure out the ...
- 2,445
33
votes
5
answers
29k
views
Open source GUI tool for decomposing a PDF
I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
- 443
32
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 9,178
30
votes
6
answers
13k
views
Decompiling Android application
The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
- 4,785
27
votes
7
answers
93k
views
Decompiling .pyc files
Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files?
Everything I've found seems to break...
- 1,041
20
votes
1
answer
8k
views
What is the state of art in LLVM IR decompilation?
LLVM IR is a fairly high-level, typed bitcode which can be directly executed by LLVM and compiled to JIT on the fly. It would not surprise me if a new executable format or programming language was ...
- 1,283
18
votes
4
answers
15k
views
Checking if an .exe is actually a .jar wrapped in an .exe
Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such ...
- 907
18
votes
4
answers
175k
views
Converting assembly code to c
I have the following assembly code over Linux distro:
# using the .data section for write permission
# instead of .text section
.section .data
.globl _start
_start:
# displaying some characters ...
- 331
16
votes
4
answers
4k
views
How to recover variables from an assembly code?
Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ?
Edit: By recovering variables, I do not mean ...
- 18.9k
15
votes
3
answers
38k
views
Reverse engineering a Visual Basic p-code binary
p-code is the intermediate code that was used in Visual Basic (before .NET). I would like to know where I can find resources/tools related to analysis of these virtual machine codes.
- 784
15
votes
3
answers
67k
views
How to decompile Linux .so library files from a MS-Windows OS?
I would like to decompile the Linux .so files.
Any tool to decompile .so files in MS-Windows based operating system ?
Any tools/methods to decompile .so files ?
- 1,097
14
votes
6
answers
14k
views
Decompilation techniques for DOS .COM files
I've found a binary copy of a DOS freeware game I was fond of back in the day (Firefighter, downloadable as FIRE.COM) but the source code is not available. I'd like to re-implement it in C or Python ...
- 141
13
votes
4
answers
29k
views
Recovering .NET sources into full blown project
I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
- 823
12
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 121
12
votes
1
answer
3k
views
Delphi Pascal Try..Except..Finally block
I'm having trouble reverse-engineering a specific Delphi Pascal .exe (old vsn., pre-1995 so probably v.3). From the system calls I understand this is probably a try..except..finally block, but I am at ...
- 2,354
12
votes
1
answer
11k
views
Where can I find tools for reverse engineering Lua
Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
- 2,320
11
votes
3
answers
107k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 119
11
votes
3
answers
18k
views
11
votes
3
answers
21k
views
How to decompile an Objective-C static library (for iOS)?
I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success.
I had no problem until I tried to display ...
- 213
11
votes
2
answers
1k
views
Is there a collaborative reversing forum for people that deal with firmware?
The question pretty much says it. Beyond knowing people that are interested in the same things, is there a collaborative reversing dumping ground for documenting specifically disassembly of closed ...
- 563
11
votes
1
answer
7k
views
concat22 in ghidra decompiler
Some portion of code I am analyzing gets decompiled as below in ghidra:
if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) &&
(*(uint *)((int)puVar9 + 6) ==
(CONCAT22(...
- 213
11
votes
1
answer
6k
views
Are the EU laws preventing reverse engineering of software products?
Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?
- 213
11
votes
2
answers
9k
views
Decompile and recompile C?
What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
- 151
10
votes
9
answers
9k
views
Is it "theoretically" possible/impossible to reverse any binary?
I know that reverse engineering from binary to source code (e.g. C++) is generally considered hard or impossible but has any computer scientist actually proven "mathematically" that it's impossible or ...
- 253
10
votes
3
answers
18k
views
Reverse engineer Android native code
I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
- 109
10
votes
3
answers
4k
views
Can you decompile Actionscript 3 on a Mac?
Reverse engineering SWFs with ActionScript 3 on a Mac typically requires a Windows VM and a lot of copying and pasting. There are some good decompilers for Windows such as as3extractor but I haven't ...
- 101
10
votes
2
answers
7k
views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
- 1,639
10
votes
4
answers
17k
views
AirPlay Mirroring decryption (FairPlay)
I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
- 346
10
votes
1
answer
5k
views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
- 1,639
9
votes
3
answers
23k
views
Get jar back from wrapped(into exe) jar
Is there any way to get a jar file from a jar wrapped using a exe wrapper.
I have an exe file and I know that it was wrapper using exe wrapper (launch4j to be precise).
How do I unwrap this jar to get ...
- 243
9
votes
1
answer
1k
views
Becoming A Better Reverse Engineer
I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
- 773
9
votes
1
answer
540
views
How to convert this one-liner asm to C
I want to convert this to C:
SHR CL,1
rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
- 101
9
votes
2
answers
10k
views
How to extract functions from one executable to include/link in another
I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
- 346
9
votes
3
answers
589
views
How to differentiate from different hex files of different families of microcontrollers?
Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or ...
- 277
9
votes
2
answers
381
views
Decompiling return-oriented programs
How are return-oriented programs decompiled/reverse engineered ?
Any pointers to any papers or reports would be appreciated.
- 668
9
votes
1
answer
948
views
Decompile "Internal Call"
I have a .NET method which is marked as an "Internal Call", meaning that it is implemented within the CLR itself. Is there any way to locate the code for and/or decompile such a method?
- 193
9
votes
0
answers
2k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 91
8
votes
5
answers
1k
views
Is it possible to hide the details of which compiler was used?
The compiler adds system information to the output/object file that is created on compilation.
Is there any compiler option that can prevent this information from being added?
Can the compiler ...
- 2,445
8
votes
1
answer
1k
views
How do you optimise AST's or convert them to a real language
I have been interested in automatic vulnerability assessment and decompilation of code for a while now. And as a result I have been building parsers in Python that reads a bin, disassembles it ...
- 2,321
8
votes
2
answers
3k
views
How to retrieve native asm code from .NET mixed mode dll file?
This is seriously one question I couldn't find the answer to anywhere on Google.com
When I mean mixed mode I mean .NET application which has unmanaged and managed code together.
I used tools
.NET ...
- 759
8
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 185
8
votes
2
answers
1k
views
IL for decompiler to human-readable format
After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example
push ebp
mov ebp, esp
sub esp, 10h
mov eax, ...
- 2,354
8
votes
1
answer
5k
views
Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better
When I decompile using IDA PRO I get code which could look like both of these
Understanding the __PAIR__ macro.
Macro itself.
// The following definition is not quite correct because it always ...
- 243
8
votes
0
answers
670
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 81