Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
2
votes
2answers
3k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
0
votes
1answer
149 views

How can I tell if a virus was made by Russians? [closed]

I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary. I have a PE file and usually I see just what compiled it (MSVS or GCC ... ...
3
votes
2answers
2k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
0
votes
1answer
223 views

Change URL a program sends data to

I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. I tried to use a debugger and checked for the URL it ...
1
vote
1answer
146 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
10
votes
4answers
15k views

AirPlay Mirroring decryption (FairPlay)

I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
1
vote
1answer
47k views

Can we decompile an .exe or .dll as %100? [closed]

Can we decompile a .exe or .dll file as 100%? Also sometimes seems some mistakes on somewhere (like mainfrm.cs) , how can we fix that? What is the best .NET decompiler? or What would you prefer? I ...
2
votes
0answers
2k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
1answer
826 views

How to display only the IR for your program code

I have a simple C program that is literally int main(void) { return 0; } When I convert this to assembly, gcc -S, it grows to around 10 lines. As expected. Then when I convert it into binary, and ...
2
votes
0answers
326 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
4
votes
4answers
2k views

Is there a tool capable of reconstructing structured code from arbitrary assembly code?

Essentially, I'm looking for a tool that could reconstruct pseudocode with conditional operators, loops, break/continue, etc. from assembly language code for an arbitrary CPU, given only a limited ...
-1
votes
1answer
366 views

Disassembling code with Hopper

I'm trying to figure out what this code is doing. The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text). Here's ...
0
votes
2answers
437 views

Smali vs Decompilation for malware detection in apk files

When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be ...
0
votes
1answer
156 views

COM file starting point

I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the ...
1
vote
1answer
5k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
1
vote
2answers
2k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
3
votes
1answer
144 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
-3
votes
1answer
357 views

IDA hexrays decompiler [closed]

Sometimes i see such lines. What do they mean, such syntax? (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4); int __fastcall sub_1(int a1, int a2) { int v2; // r4@1 int v3; // ...
1
vote
1answer
7k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
1
vote
1answer
116 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
1
vote
1answer
584 views

Encryption (AES-128) in automatic meters reading

I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters). Here's some introduction. I was trying to read a ...
1
vote
0answers
805 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
3
votes
1answer
353 views

move with sign extension in c code

I'm quite confused with the movsx(move with sign extension) I'm trying to convert assembly code to C. but stuck with movsx part. this is the code I got so far. #include <stdio.h> #...
2
votes
1answer
2k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
1
vote
1answer
136 views

3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective,

Following the question here (3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)), I would like to know for the same x86 code in AT&T syntax: xor $0x20, (%eax) ...
1
vote
2answers
332 views

3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)

For the following example, using x86 code in AT&T format: xor $0x20, (%eax) and $0x20, %ah or $0x20, %dh dec (%edi) dec %si dec %sp dec %bp My understanding: Line 1: takes value in %eax and ...
2
votes
2answers
736 views

Legal risks of retro engineering a 19 years old game

I am quite new to retro-reverse-engineering, and I am concerned about my current hobby. Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (...
3
votes
1answer
16k views

What to do with ILSpy error “This file does not contain a managed assembly”?

I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: This file does not contain a managed assembly. I have also tried to use ...
1
vote
2answers
3k views

How to extract the OS files from this firmware bin file

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive: binwalk modem.bin DECIMAL HEX ...
9
votes
3answers
3k views

Can you decompile Actionscript 3 on a Mac?

Reverse engineering SWFs with ActionScript 3 on a Mac typically requires a Windows VM and a lot of copying and pasting. There are some good decompilers for Windows such as as3extractor but I haven't ...
0
votes
0answers
469 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
0
votes
1answer
2k views

IDA pseudo code decompilation

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding. Can someone please help me understand what is doing the code below: char __userpurge sub_41C140@<...
16
votes
4answers
3k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
-2
votes
1answer
519 views

How decompilation works? [closed]

what is the theory behind the subject of translate assembly code to pseudo code? Could you explain few words ? Also some book about it?
0
votes
1answer
624 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
6
votes
1answer
700 views

Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?

I am learning reverse engineering, and would like a way to try out methods I'm learning. In web security, the way to try out and learn methods is a thing called DVWA. It is an insecure web app made ...
3
votes
1answer
2k views

Reverse engineering Lingo scripts .DCR/.CCT files

I was wondering if I could get some tips on reverse engineering .dcr/.cct files to get Lingo scripts. I know with recover-cct/recover-dir you can get all the assets etc. but you can't get Lingo ...
0
votes
1answer
121 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
41
votes
3answers
22k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
1
vote
0answers
81 views

Am I seeing this dll's innards correctly? [closed]

The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003). My ...
2
votes
1answer
568 views

Compile Hex-Rays code

I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it. So far I stopped on instructions like that: char (__usercall *__fastcall sub_947770(...
10
votes
3answers
19k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
3
votes
1answer
89 views

How would one find test cases for a self-implemented value set analysis (VSA)?

I read a blog post about value set analysis (VSA). For VSA, see e.g. here. The blog author writes I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I ...
1
vote
1answer
2k views

Can my C# program be dumped from memory and reversed into source code?

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded ...
2
votes
1answer
160 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
0
votes
2answers
417 views

Static Linking as an anti-RE method?

A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
1
vote
0answers
359 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
4
votes
1answer
1k views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
2
votes
1answer
2k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...

1
4
5
6 7 8