Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
1
vote
1answer
2k views

How can I modify or decompile Hermes JS bytecode?

Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode. The Hermes documentation mentions hbcdump ...
0
votes
1answer
46 views

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3 im little confused about memory organization values i should put in the memory organization thank you for ...
1
vote
1answer
320 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
2
votes
0answers
115 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
4
votes
2answers
303 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
2
votes
1answer
233 views

How to reverse engineer cx_Freeze exe's?

How to reverse engineer Python scripts turned into binaries with cx_Freeze?
0
votes
1answer
146 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
0
votes
1answer
68 views

Custom IDA Decompilation Format

Is there a way to customize the format of IDA's decompiled code? e.g. char buf[7]; // [rsp+5h] [rbp-1Fh] to char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ] or switch (c) to switch( c )
1
vote
1answer
122 views

Can you decompile code if you Know the Complier?

My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to ...
4
votes
2answers
493 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
0
votes
1answer
159 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
-1
votes
1answer
619 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
4
votes
0answers
294 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
0
votes
1answer
79 views

Understanding how a WiFi camera app goes from packet data to video stream

I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte ...
1
vote
1answer
327 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
1answer
114 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
1
vote
2answers
269 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
1
vote
1answer
62 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
-1
votes
2answers
128 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
-1
votes
1answer
101 views

Is decompilation easier or generally more accurate for smaller ISAs?

I am wondering if decompilation would be easier for an ISA with fewer instructions. For example, RISC-V vs x86.
0
votes
2answers
150 views

Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
0
votes
1answer
604 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
2
votes
0answers
116 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
2
votes
1answer
384 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
1
vote
2answers
720 views

Batch decompile using IDA Pro 7.5

I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
5
votes
2answers
472 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
-1
votes
1answer
134 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
-2
votes
1answer
171 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
1
vote
1answer
200 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
3
votes
1answer
961 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
1
vote
1answer
106 views

Issue understanding simple ARM ASM function

I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
0answers
157 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
2
votes
0answers
6k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
-1
votes
1answer
283 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
0
votes
2answers
407 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
1
vote
2answers
255 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
2
votes
1answer
102 views

Ghidra Python - cancel decompilation task

The way to decompile a function in Ghidra Python is: decomp = DecompInterface() decomp.openProgram(currentProgram) decompile = decomp.decompileFunction(func, 1000, monitor) However, in ...
0
votes
0answers
83 views

Force gcc to use more complex instructions

I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that ...
4
votes
1answer
1k views

How to improve Ghidra decompilation of SSE instructions?

In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried ...
1
vote
2answers
340 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
3
votes
1answer
676 views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
1
vote
1answer
154 views

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc. I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
1
vote
3answers
490 views

inspecting c-sky elf application

I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver the receiver is based on c-sky v1 architecture searching forums , I managed to get the firmware ...
-1
votes
1answer
88 views

Automatic decompilation from Assembly x86

Is there a tool to automatic decompile an assembly x86 code? What I need is a tool where I simply paste my code and it returns C code. Thanks
0
votes
0answers
604 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
0
votes
1answer
517 views

Ghidra Python - Get Decompile Line Text by RVA

Is there a way in Ghidra Python to get the corresponding decompile line by RVA? Or the opposite - get the corresponding RVA from a given line in a decompile?
2
votes
1answer
170 views

Find password in a c compiled binary file

I'm currently learning to do some basic reverse engineering of binary files using Cutter. The program i'm struggling on test if the password entered as argument is correct, if not, return an error ...
0
votes
1answer
49 views

structures defined on stack?

While reading this paper on type recovery from executables, I came across following paragraph: It is worth noting that the domain of parameters of a function can be considered as a structure ...
0
votes
1answer
163 views

"check:" keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
1
vote
1answer
633 views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...

1
2
3 4 5
9