Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
0 votes
2 answers
202 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
user avatar
1 vote
0 answers
78 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
user avatar
  • 11
0 votes
0 answers
125 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
user avatar
1 vote
1 answer
107 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
user avatar
0 votes
2 answers
120 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
user avatar
0 votes
1 answer
245 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
user avatar
0 votes
1 answer
78 views

Is the code like this reverse able? (from Assembly - UnityScript)

i try to reverse this code but cant figure it out what is this number mean or how to call it...
user avatar
0 votes
1 answer
381 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
user avatar
3 votes
1 answer
290 views

Specifying the register value which is constant for all the functions

In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables. e.g. register r13 is set to 0x40000000 which ...
user avatar
  • 1,760
0 votes
1 answer
41 views

How to force a program to run as monothread for dynamic analysis?

I'm reversing a program with x64dbg and ida (I switched from ghidra), hence disassembled and decompiled, I need to understand what is happening with dynamic analysis, but I have a tricky part where ...
user avatar
  • 123
0 votes
1 answer
184 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
user avatar
0 votes
1 answer
53 views

Reverse engineering mode X VGA function(s)

I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
user avatar
1 vote
0 answers
82 views

Ghidra SDK Register TypeFlags are not populated

I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
user avatar
  • 11
2 votes
1 answer
131 views

Can obfuscation be applied on certain parts?

I am newbie to this field. I am still learning from your wonderful contributions, help and guidance. I have had an app that i want to study in-depth. How the the it is constructed? What components ...
user avatar
  • 21
1 vote
1 answer
124 views

Converting a data address offset to the equivalent struct in a C++ module

I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so: v32 = ( v3 + ...
user avatar
  • 21
0 votes
2 answers
2k views

Modifying UnityPlayer.dll with dnSpy or other

I've been looking into reverse engineering a game developped with Unity 2017.4.10, to find a way to get a freely controlled camera. I found the values that interest me in Managed/Assembly-CSharp.dll ...
user avatar
2 votes
2 answers
4k views

How can I modify or decompile Hermes JS bytecode?

Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode. The Hermes documentation mentions hbcdump ...
user avatar
  • 123
0 votes
1 answer
52 views

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3 im little confused about memory organization values i should put in the memory organization thank you for ...
user avatar
1 vote
1 answer
537 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
user avatar
  • 111
2 votes
0 answers
117 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
user avatar
  • 21
4 votes
2 answers
488 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
user avatar
2 votes
1 answer
360 views

How to reverse engineer cx_Freeze exe's?

How to reverse engineer Python scripts turned into binaries with cx_Freeze?
user avatar
0 votes
1 answer
194 views

Converting rep movsd to to C without memcpy

So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
user avatar
  • 723
0 votes
1 answer
84 views

Custom IDA Decompilation Format

Is there a way to customize the format of IDA's decompiled code? e.g. char buf[7]; // [rsp+5h] [rbp-1Fh] to char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ] or switch (c) to switch( c )
user avatar
  • 113
1 vote
1 answer
168 views

Can you decompile code if you Know the Complier?

My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to ...
user avatar
  • 33
4 votes
2 answers
642 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
user avatar
  • 1,469
0 votes
1 answer
174 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
user avatar
-1 votes
1 answer
860 views

Extract PYZ Error

I successfully recovered some PYC files from an ELF built by PyInstaller (https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries). There is a PYZ archive in the dump. I ...
user avatar
  • 99
4 votes
0 answers
341 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
user avatar
  • 149
0 votes
1 answer
104 views

Understanding how a WiFi camera app goes from packet data to video stream

I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte ...
user avatar
  • 11
2 votes
1 answer
478 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
user avatar
  • 21
0 votes
1 answer
134 views

How do i identify parameters function of md5sum of specific binary?

So, i downloaded the binary. Here are some details before moving forward: revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,...
user avatar
1 vote
2 answers
420 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
user avatar
1 vote
1 answer
81 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
user avatar
  • 599
-1 votes
2 answers
134 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
user avatar
-1 votes
1 answer
114 views

Is decompilation easier or generally more accurate for smaller ISAs?

I am wondering if decompilation would be easier for an ISA with fewer instructions. For example, RISC-V vs x86.
user avatar
  • 133
0 votes
2 answers
160 views

Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?

I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C. The first time someone asked me about this project I told them I was 'reverse ...
user avatar
  • 133
0 votes
1 answer
874 views

How to make Ghidra recognize bit fields?

Suppose we have the following C source: typedef struct { int bit0 : 1; int bit1 : 1; int bit2 : 1; int bit3 : 1; } bit_struct; bit_struct a; void setBit3() { a.bit3 = 1; } When we compile ...
user avatar
  • 3
2 votes
0 answers
136 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
user avatar
  • 121
2 votes
1 answer
566 views

How do we decompile java so easy?

I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
user avatar
1 vote
2 answers
834 views

Batch decompile using IDA Pro 7.5

I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
user avatar
5 votes
2 answers
618 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
user avatar
-1 votes
1 answer
138 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
user avatar
  • 219
-2 votes
1 answer
191 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
user avatar
  • 219
1 vote
1 answer
273 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
user avatar
  • 13
3 votes
1 answer
1k views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
user avatar
  • 239
1 vote
1 answer
113 views

Issue understanding simple ARM ASM function

I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
user avatar
  • 35
1 vote
0 answers
231 views

Removing/bypassing a BIOS whitelist

I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've used flashrom and a soic8 clip to dump the bios to a bios.img file made another dump and compared with diff bios....
user avatar
2 votes
0 answers
7k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
user avatar
-1 votes
1 answer
443 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
user avatar
  • 136

1
2
3 4 5
9