Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
1 vote
0 answers
189 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
user avatar
  • 723
1 vote
2 answers
148 views

Strings weirdly split in binary

Recently I have come across a few parts in a binary that looked odd to me, and I wanted to ask if this is something common compilers do, and if there is a way to undo it. (The binary is from a raw ...
user avatar
1 vote
0 answers
120 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
user avatar
1 vote
0 answers
77 views

(Help) APK Decomplied unreadable .pngs

I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
user avatar
-1 votes
1 answer
170 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
user avatar
  • 1
1 vote
1 answer
477 views

Confusion about LEA and why it means what it does in this context

I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example. The first part of it is fairly straightfoward- 7C921A39 MOV EDI,EDI 7C921A3B PUSH EBP ...
user avatar
1 vote
1 answer
4k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
user avatar
  • 151
2 votes
1 answer
636 views

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
user avatar
1 vote
0 answers
335 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
user avatar
  • 11
0 votes
1 answer
437 views

Search string in all binary pesudo-code

How can I search pesudo code string in all functions in binary with Ida?? Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c) I want to search for example where ...
user avatar
  • 513
1 vote
1 answer
1k views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
user avatar
3 votes
1 answer
685 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
user avatar
3 votes
1 answer
407 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
user avatar
  • 163
1 vote
0 answers
255 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
user avatar
2 votes
0 answers
241 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
user avatar
0 votes
0 answers
126 views

(Help)Apk Decomplied unreadable files

I'm developing an android-based game for my school project. I chose an .apk to reference the visual parts. I've decompiled the .apk file I've specified. I can't view the image files I need. files ...
user avatar
  • 1
6 votes
1 answer
9k views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
user avatar
  • 161
0 votes
1 answer
119 views

Is it possible to recover the key to a decrypted file?

Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how? The file I want to recover the key from is a xml that looks like ...
user avatar
9 votes
1 answer
4k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
user avatar
  • 1,315
2 votes
1 answer
876 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
user avatar
1 vote
0 answers
136 views

deobfuscating/decompiling extremely complicated javascript [closed]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
user avatar
0 votes
1 answer
697 views

Unable to decompile C Code

Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
user avatar
  • 27
10 votes
2 answers
6k views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
user avatar
  • 1,315
1 vote
1 answer
294 views

Decryption loops

I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this: for ( i = 0; i < n; ++i ) { v22 = *((_BYTE *)sub_5657D89B + i); v0 = v22 ^ 0x90; v1 = strlen(&...
user avatar
  • 429
-1 votes
1 answer
519 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
user avatar
  • 1
1 vote
0 answers
144 views

Is there any way to execute Hopper scripts from command line?

What should I do if I have a batch of binaries to decompile with Hopper? I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
user avatar
  • 11
0 votes
1 answer
354 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
user avatar
  • 204
1 vote
0 answers
372 views

How to decompile these LUAs from the Bookworm Adventures games?

I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
user avatar
0 votes
1 answer
216 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
user avatar
  • 3
1 vote
1 answer
4k views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
user avatar
2 votes
0 answers
836 views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
user avatar
  • 121
1 vote
1 answer
3k views

How can I make IDA understand this switch statement with a signed jump table?

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0: int main() { int a = 0; for (int i = 0; i < 5; i++) { switch (i) { case 0: a = 1; break; ...
user avatar
4 votes
1 answer
505 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
user avatar
1 vote
0 answers
34 views

How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?

When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that ...
user avatar
1 vote
0 answers
686 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
user avatar
0 votes
1 answer
404 views

Multiple decompilation failure with ntoskrnl

IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that: I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
user avatar
  • 1,469
3 votes
1 answer
850 views

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

Given the following short assembly snippet: shr rax, 3 adc rax, 0 I worked this out a bit: We know SHR sets the CF with the last bit shifted. We know ADC dest, 0 is just adding the CF. So ...
user avatar
  • 1,664
2 votes
1 answer
1k views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
user avatar
  • 165
1 vote
1 answer
864 views

Figuring out what a segment of assembly code does

I have the following assembly code: 0000000000400711 <foo>: 400711: 55 push rbp 400712: 48 89 e5 mov rbp,rsp 400715: 48 89 7d e8 ...
user avatar
  • 165
1 vote
0 answers
330 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
user avatar
  • 21
2 votes
1 answer
4k views

What does this assembly language program output?

I have been struggling with this for a long time. I have the following assembly language code: .intel_syntax noprefix .bits 32 .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD ...
user avatar
  • 165
5 votes
1 answer
785 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
user avatar
1 vote
1 answer
873 views

What is the password to this file? I can't figure it out with radare2 or gdb

Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing I am able to figure out some of the assembly, but can't get the correct password. I know ...
user avatar
  • 135
1 vote
1 answer
2k views

How do the AI in Pokemon battles work?

Has anyone ever attempted to decompile the code for a Pokemon game and figure out how the battle AI works? e.g. How it decides which move to use, or use a Potion/even withdraw based on the current ...
user avatar
  • 111
2 votes
3 answers
457 views

How to identify the purpose behind a bitmask?

The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly: mov r8d, 0FFFFFFF8h ...
user avatar
  • 1,469
2 votes
1 answer
143 views

Do all class instances have a relative address/offset and can i make a copy of any class pointer?

I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such. And I have applied that to some of my own code in the past. But does this practice ...
user avatar
-3 votes
1 answer
834 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
user avatar
0 votes
1 answer
1k views

Generate c like pseudo code from objdump output

Ida has a feature which generates pseudo code from assembly. Is there a tool under Linux that make the same job, from objdump output for example ?
user avatar
  • 613
2 votes
0 answers
594 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
user avatar
  • 1,469
2 votes
1 answer
339 views

Android 7.0+ Monitoring application HTTPS requests

I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining ...
user avatar
  • 21

1 2 3
4
5
9