Questions tagged [decompilation]
Process of translating assembly code extracted from a binary file in a structured programming language, such as C.
556
questions
2
votes
0
answers
2k
views
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:
This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as ...
- 83
0
votes
1
answer
407
views
Deobfuscator and decompiler for .NET [closed]
Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
- 11
0
votes
1
answer
254
views
How to reference an address set by 2 instructions in Ghidra
I encountered the following 2 instructions while reversing Tricore assembly:
These 2 instructions load the final address: 0x804A9474. Where a global symbol resides.
Is there a way to hint Ghidra the ...
- 43
2
votes
0
answers
847
views
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)
My Assembly code looks like this:
.global _start
_start:
...
- 33
1
vote
1
answer
166
views
Custom IDA Decompilation Coloring
Is there a way to customize the coloring of IDA's decompiled code?
IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
- 113
0
votes
1
answer
85
views
How to make Ghidra don't brake mid token with triple dots?
So I was scraping the Ghidra disassembly output until I realized that some of my tokens are ...
Anyone knows how can I configure this up so Ghidra doesn't limit the output of it's disassembler (...
- 425
0
votes
0
answers
37
views
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
- 763
1
vote
2
answers
978
views
Is it possible/feasible to decompile a program written in C++ to C?
I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know.
If it is possible, ...
- 21
1
vote
1
answer
1k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
1
vote
2
answers
125
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 49
0
votes
0
answers
95
views
Malware analysis of undetected NodeJS token grabber
I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'.
Someone contacted me asking to playtest a game, which prompted a .exe file.
I ran the file and website on ...
2
votes
2
answers
267
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 573
1
vote
0
answers
430
views
Decompiling a Node.js application compiled with nexe
Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker.
Judging by folders created in my user directory, multiple ...
- 11
2
votes
1
answer
213
views
identify the functions of stripped binaries
As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
1
vote
1
answer
283
views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
- 113
2
votes
1
answer
107
views
Useless instructions in a compiled getter
This is the second time I see this kind of function today :
.text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p
.text:00000000000010B0 lea ...
- 23
1
vote
1
answer
291
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 160
5
votes
1
answer
8k
views
Decompile a NodeJS compiled program maybe by NEXE
I recently got idiotly scammed one of my discord account but kept the malware in case.
Curious, I would love today to break into the executable to fetch any information about the scammer.
I decompiled ...
- 51
0
votes
0
answers
112
views
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
- 306
1
vote
0
answers
39
views
What is the correct argument for the disassembled function / constructor?
I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
- 306
1
vote
3
answers
700
views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0
answers
44
views
Decompiled VB 6.0 Application Call Statement
I decompiled a VB application using VB Decompiler pro. It contains the following call statements:
Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98))
Can you please ...
- 1
1
vote
1
answer
481
views
Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?
Background:
The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
- 153
2
votes
1
answer
2k
views
How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)
Let's say there is a default base address for the application image on both IDA and Ghidra and it is equal to 140 000 000.
If the function address is: 140 039 ea0
Does it mean that the offset from the ...
- 306
0
votes
0
answers
161
views
Procyon vs CFR for Java Decompiler
I'm trying to find the best Java class decompiler thats the most reliable. What's the difference between Procyon and CFR as far as decompiling the most classes sucessfully?
- 101
2
votes
1
answer
1k
views
convert C++ code to python code
while I'm doing RE using ghidra i saw this code
byte bVar1;
byte bVar2;
uint uVar3;
uVar3 = 0;
while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') {
bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
2
answers
81
views
why does dalvik remove invocations during optimisation?
This is original smali code of a classes.dex method before installation
.method public static createAutoMatchCriteria(IIJ)Landroid/os/Bundle;
.registers 6
new-instance v0, Landroid/os/Bundle;
...
- 154
0
votes
1
answer
97
views
How to make sense of the pointer in reversed function call?
I have the code below, derived from the reversed function in the original application:
gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50));
The create function ...
- 306
1
vote
1
answer
2k
views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
- 21
1
vote
0
answers
160
views
ZKM 15 Deobfuscation (Jar file) [closed]
Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me.
I am willing to pay money for this.
I mostly just need Strings from the jar file. It doesn't need to be perfect.
...
- 11
2
votes
1
answer
247
views
uncompyle6 gives success message but output is not readable
I am trying to use uncompyle6 to decompile a .pyc code. I even tried --verify option. It says
Successfully decompiled file
but the output only contains strings like \xe0\xb3\x0bh\x90.
What should I ...
- 21
0
votes
0
answers
613
views
Improving Ghidra's Auto-Structure creator
I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
- 113
2
votes
2
answers
495
views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
- 21
1
vote
0
answers
320
views
Decompiling dll file to extract a function (subroutine)
I have a university project, and my professor gave me a DLL file which I need to extract a subroutine from, and it is not clearly defined as a subroutine. The purpose is to translate the code to C++ ...
- 111
2
votes
0
answers
89
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 73
2
votes
2
answers
325
views
Is decompilation significantly more limited when performed on handwritten assembly?
I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
- 125
2
votes
0
answers
182
views
How can I extract working files (in the form of graphics) from these MZP executables?
There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
- 21
0
votes
0
answers
311
views
Decompiling exe to python source code
I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part:
--- This ...
- 1
1
vote
0
answers
265
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
2
votes
0
answers
2k
views
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
- 21
0
votes
2
answers
282
views
convert code to python
i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc..
the first code:
void one(int param_1,int param_2) {
int ...
1
vote
4
answers
559
views
Are there any 64 bit MIPS decompilers
I’ve found many mips 32 bit decompilers. I’m trying to decompile a simple 64bit elf from mips to c. Ida doesn’t seem to have much of a problem with disassembly. After some fixings I tried the ...
1
vote
0
answers
180
views
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :
UmdUsFrEB3wGMuuAz1Znywuedx6+...
- 11
0
votes
0
answers
131
views
How do I decode or decompile this class It seems codes are encrypted?
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.
Code:
public ...
