Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
1
vote
1answer
519 views

How to find the executable code of the native method in the library * .so? (Android)

I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
0
votes
2answers
857 views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
4
votes
1answer
682 views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
315 views

Translating ida macros and pseudocode into C++/C

What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh v8 = (...
60
votes
7answers
115k views

Possibilities for reverse engineering an ipa file to its source

I browsed a lot, but can't find any resources for reverse engineering an ipa file (iPhone application). Is there any method to reverse engineer an ipa file to its source? I've tried to rename it to ...
1
vote
1answer
1k views

Would it be possible to reverse engineer a game's rom file to get source code?

More specifically, could you get low level code from a rom, and piece it together and translate it to a higher level language?
3
votes
1answer
1k views

How to unpack Inno Setup bundles with Arc+SREP data?

I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with .bin extension) that I was unable to extract using normal methods: the installer didn't work for an ...
2
votes
0answers
117 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
2
votes
2answers
3k views

IDA Hex-Rays Decompiler : Show strings instead of offset

How can i settings IDA show me string instead of offset_xxx?
10
votes
1answer
4k views

Are the EU laws preventing reverse engineering of software products?

Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?
4
votes
1answer
358 views

Help understand decompiled IDA code

I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks! File : https://www.sendspace.com/file/3yowjg Password : 1 void __fastcall sub_A513C0(char *Src, HWND ...
1
vote
0answers
491 views

Decompiling or modifying .exe file generated from .jar

I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
0
votes
1answer
316 views

How add String.equals to java bytecode (Krakatau)

I use Krakatau to edit java code. class test{ public boolean Func2(String text) { if(text=="aaaaaa") return true; return false; } } When I compile it I get this java bytecode ....
1
vote
0answers
93 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
3
votes
1answer
1k views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
5
votes
1answer
3k views

dnSpy - What do these symbols mean?

When decompiling a dll file there are certain lines of code that read like this: return \u0013.\u0002.\u0001(url, info); I have two questions on this: 1) does \u00xx mean that it is obfuscated, if ...
2
votes
1answer
644 views

How to do i fix it when IDA pro mislabels values as loc_

Some times the psuedo code generated by IDA is baffling v8 = (signed int)&loc_100010; //ida v8 = 0x100010; //actual code This is not so bad when it is just one value but sometimes the offset for ...
1
vote
0answers
204 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
3
votes
1answer
250 views

Disassemble/decompile arbitrary JVM bytecode

I have an obfuscated java binary which does runtime code injection using java reflection like this. Object o = "a long string"; ((Method)o).invoke(params..); (If I write this in a java file, it ...
-1
votes
1answer
245 views

Fixing IDA Member functions argument order

When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type ...
5
votes
3answers
6k views

What exactly is binary disassembly and what it produces?

The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought ...
35
votes
3answers
28k views

How do I figure out what is burned on an Arduino ROM?

I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board. How do I extract the code from the board? How do I figure out the ...
1
vote
1answer
497 views

De-compiling a random file format to retrieve the files?

Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. I've read multiple posts that mention ...
1
vote
2answers
3k views

.NET: It's possible to recover original source code from compiled .exe when I have all the .vshost, .pdb and compiled files?

I have the compiled code with all .pdb, vshost and everything that is generated. I am already using DotPeek without too much hassle. Would like to know If I can retrieve the original code with all the ...
3
votes
3answers
2k views

Android- hiding private keys in .so file

I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
0
votes
3answers
2k views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
1
vote
5answers
324 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
1
vote
1answer
250 views

Unknown record type in Intel Hex file

I was working on a USB thumbwheel bootloader and reading in a number of records successfully, but around 2000 bytes it throws a check_sum error. I initially figured it had to be my code, but having ...
6
votes
1answer
552 views

How to tell if a particular .NET assembly was written in C# or F#?

The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code. Why does decompiling an F# assembly produce C# ...
1
vote
0answers
388 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
2
votes
1answer
536 views

Macho - remove a LOAD COMMAND from iOS binary

I want to remove a LOAD_COMMAND from my iOS app binary. I tried jtool: jtool -rC 3 my_app_binary This worked when I was removing a dynamic library. But it generated an empty binary file and the ...
1
vote
1answer
125 views

Static Offset in PE

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password. The problem is I use a part of code into the main function to search the opcodes from .text section ...
-1
votes
1answer
245 views

Reversing a function, methodology

Which are the methods or which are the steps for from a asm disassembled function code passing/converting it to 'C/C++' or other language and tell what happens.
1
vote
1answer
342 views

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC. Is there a tool that can either: Translate the binary from x86-64 to PPC (...
1
vote
1answer
84 views

Object references representation in pseudocode

I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects. Let's say I'm looking at a line of code in a function called ...
1
vote
1answer
1k views

can't edit class file with recaf.0.9 without re-compile

I have this java code public class HelloWorld { public static void main(String[] args) { System.out.println("Hello World!"); } } I compile to class file, run it , and all fine. I ...
0
votes
1answer
181 views

AT&T - Does assembly code return whatever is in %eax by default?

I have the following AT&T assembly code: movl 12(%ebp),%eax cmpl %eax,8(%ebp) jle L7 movl 8(%ebp),%eax L7: leave I'm supposed to "transpose"(??) it to C code. I actually just have to ...
1
vote
0answers
172 views

Is it possible to correctly disassemble STL inlines?

Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see ...
0
votes
1answer
233 views

Encrypted String? [closed]

(I made a topic but I was ask'd to re-made it) Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(...
1
vote
0answers
78 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
6
votes
3answers
74k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
2
votes
1answer
23k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
3
votes
1answer
9k views

How do Enigma, Themida and VMProtect compare to each other?

I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find ...
2
votes
1answer
514 views

How to deobfuscation the public class names .NET

I already try de4dot with all dlls and exe and try remove strong name and don't work. what am I doing wrong?
1
vote
1answer
104 views

Android Intercepts for log the Funtion Calls to javax

Im reversing an apk that uses a native library .so to make calls to some Java methods thru reflexion I know by analysing the app that exist the followings calls: import javax.crypto.Mac; import ...
1
vote
1answer
47k views

How to decompile an exe file? [duplicate]

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? How to decompile exe files ...
2
votes
2answers
14k views

Is it possible to convert matlab p-code to something viewable?

A simple disp("Hello World") gave me this : 7630 312e 3030 7630 302e 3030 0007 301c d3e7 7fb1 0000 0004 0000 002a 0000 0035 4c97 ee76 779b d4b9 3948 d7ea 798c 05ba c67a 2a56 c4de d7f9 7446 1d59 0472 ...
2
votes
1answer
265 views

Why function names are visible in a decompiled iOS app?

While decompiling an iOS app, all function names and object names are visible. Why ? My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. ...
1
vote
0answers
515 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
1
vote
1answer
3k views

Download and Decompile an Ios app [closed]

I want to write an automatic process that downloads an ios app and decompile it? I couldn't find any source or method to download an ios app without using any Apple Device.

1 2 3
4
5
8