Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
5
votes
1answer
2k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
2
votes
2answers
53 views

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

I'm trying to decompile an old binary (about 20 year old). The program uses exceptions. I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0. I've tried many options ...
-1
votes
1answer
52 views

Automatic decompilation from Assembly x86

Is there a tool to automatic decompile an assembly x86 code? What I need is a tool where I simply paste my code and it returns C code. Thanks
7
votes
2answers
889 views

IL for decompiler to human-readable format

After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example push ebp mov ebp, esp sub esp, 10h mov eax, ...
0
votes
0answers
171 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
1answer
126 views

Ghidra Python - Get Decompile Line Text by RVA

Is there a way in Ghidra Python to get the corresponding decompile line by RVA? Or the opposite - get the corresponding RVA from a given line in a decompile?
0
votes
1answer
44 views

structures defined on stack?

While reading this paper on type recovery from executables, I came across following paragraph: It is worth noting that the domain of parameters of a function can be considered as a structure ...
2
votes
1answer
76 views

Find password in a c compiled binary file

I'm currently learning to do some basic reverse engineering of binary files using Cutter. The program i'm struggling on test if the password entered as argument is correct, if not, return an error ...
0
votes
0answers
220 views

What are good tips to reverse engineering code with no variable name information and loss of the debug information?

I am a exploiter for roblox which mean that I execute scripts via an external program called an exploit on running roblox games. To make script for my exploits, I have to use debugging library and ...
0
votes
1answer
86 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
-2
votes
1answer
1k views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
0
votes
0answers
110 views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
91 views

Is this file compressed, and if yes what type of compression is it. And how can I find it myself

I'm once again stuck on a binary image, which seems like it might be compressed, but I can't find any way to detect the compression used, let alone decompress it. The binary in question is from a "...
0
votes
1answer
57 views

IDA subroutine code running when not being called

Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
-1
votes
1answer
52 views

How to find where a subroutine is being called (ida)

I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
2
votes
1answer
964 views

Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”

This is the part of the picoCTF 2019 problem "Investigative Reversing 0". I've encountered the following code when using Ghidra: if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) { /*...
1
vote
0answers
241 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
1
vote
0answers
63 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
2
votes
1answer
3k views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
1
vote
0answers
155 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
2
votes
0answers
117 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
1
vote
2answers
145 views

Type reconstruction ambiguity

In TIE: Principled Reverse Engineering of Types in Binary Programs, Lee J. et al claim to solve most of the challenges in the process of C code decompilation that come with type reconstruction. While ...
0
votes
2answers
305 views

IDA - How to resolve “Write access to const memory detected” error?

I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices ...
1
vote
1answer
639 views

How do I read this decompiled code?

I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called ParseCommandLine, but I don't understand what it is doing. I ...
9
votes
3answers
18k views

Get jar back from wrapped(into exe) jar

Is there any way to get a jar file from a jar wrapped using a exe wrapper. I have an exe file and I know that it was wrapper using exe wrapper (launch4j to be precise). How do I unwrap this jar to get ...
1
vote
1answer
187 views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
0
votes
1answer
135 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
1
vote
1answer
77 views

Type inference inconsistency

I'm testing several decompilers against the following C code static int bar(int i) { return ++i; } static int apply(int (*fun)(int), int i) { return i % fun(i); } static int foo(int (*app)(...
9
votes
2answers
4k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
2
votes
1answer
123 views

IDA pseudocode support

How can I know which processors IDA knows how to view pseudocode of? If IDA does not know to view pseudocode for my processor, how can I fix that??
4
votes
2answers
289 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
0
votes
0answers
47 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
7
votes
2answers
14k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
0
votes
0answers
125 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
1
vote
0answers
50 views

Finding PEM passphrase that may be in an executable?

I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
0
votes
0answers
735 views

Deconstructing Unity games

Note: I only want to edit/mod the games not trying to steal things etc. I'm trying to deconstruct some Unity games from both PC and Android platforms and already extracted assets with uTinyRipper ...
1
vote
2answers
138 views

Can I decompile a file if I have a compiler? [closed]

Is it possible to reverse the compiled code using a compiler? I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file. ...
1
vote
1answer
376 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
0
votes
1answer
134 views

How to decrypt a file who encryption and key is unknown? [closed]

Here is the file that I am trying to findout a way to decrypt. settings.ini This file is from the settings of the MetaTrader 5. The same is the name of the application. Kindly suggest a better way so ...
0
votes
1answer
672 views

How do I reverse engineer a game using dnSpy?

I've been reading some about reverse engineering and decided to try to learn as I go, which has proven somewhat difficult. Sorry about the generic title, I'll try and give enough info so it can be ...
1
vote
0answers
111 views

Is there any way to execute Hopper scripts from command line?

What should I do if I have a batch of binaries to decompile with Hopper? I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
2
votes
1answer
269 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
6
votes
1answer
1k views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
13
votes
4answers
20k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
0
votes
0answers
72 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
1answer
3k views

Issue decompiling c# method

I'm trying to decompile a c# dll and on a particular method I'm getting this result public IEnumerable<Guid> GetDbIdentifiers(int classId) { switch ((794999935 == 794999935) ? 1 : 0) { ...
2
votes
2answers
244 views

Java reverse engineering tool [closed]

I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it. I've tried PNF's JEB which is really perfect but it's only for Android stuff....
2
votes
0answers
623 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
1
vote
0answers
211 views

How to decompile these LUAs from the Bookworm Adventures games?

I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
1
vote
0answers
63 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...

1
2
3 4 5
8