Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
-4
votes
1answer
2k views

Is it possible to decompile the password protected rar file? [closed]

I'm trying to crack winrar's password using some methods as explained below. Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years. But, if we ...
1
vote
1answer
171 views

Getting Encryption Method When I Know Encrypted File Name & Original File Name

I'm busy trying to decrypt some game data. All the encrypted filenames are hexadecimal strings with the same length e.g. 1790C6E445C7E38EFCD5B3042F9B4443. I've figured out that a few of the files ...
3
votes
1answer
6k views

What is the meaning of *(_DWORD *)

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. for ( i = 0; i < 6; ++i ) { v7 = (int)&val_253; for ( k = 1; k < ...
1
vote
1answer
139 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
1
vote
0answers
726 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
1answer
107 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
1
vote
1answer
638 views

Help with analysis from IDA Pro Hex-Rays dump

I'm trying to reverse-engineer a file format, and I got a buddy of mine (who works in the security field) to decompile the program via Hex-Rays and give me the resulting .C file. I've spent the past ...
-3
votes
1answer
319 views

What are the risks of running a decompiler? [closed]

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb. I've searched and ...
3
votes
2answers
6k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
7
votes
1answer
792 views

IL for decompiler to human-readable format

After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example push ebp mov ebp, esp sub esp, 10h mov eax, ...
2
votes
1answer
3k views

Stronger than Themida?

I am new to reverse engineering and file protections. I have made a trading algorithm for Tradestation that I have put into a C++ DLL instead of having the source laying around, and I want to protect ...
0
votes
1answer
100 views

Understanding pseudocode containing a math operation in a variable assignment [closed]

So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. The code in particular iterates through every byte of the encrypted file, ...
0
votes
1answer
135 views

Windows PKZIP encryption / compression calls might be altering password?

I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file... basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,...
2
votes
1answer
188 views

How to locate the code used for encryption

I've been playing around with recording packets being sent to and from applications on my pc. Logically any program that sends or receives packets must have the encryption scheme used. So I'd like to ...
0
votes
1answer
3k views

How to decompile python [duplicate]

How can I decompile python 3.3 files ?? Can you please suggest me a tool for linux ubuntu 14.10 in specific note easy decompiler didn't work for me :(
4
votes
1answer
961 views

Coalesce Enums in IDA?

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums? For instance, I have the following enums, HTTP_QUERY_CONNECTION has the value 23 and ...
3
votes
1answer
12k views

what's the function of LODWORD and HIDWORD?

I'm trying to figure out what does this piece of code exactly: LODWORD(fMax) = *(_DWORD *)v12; HIDWORD(fMax) = v13; I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
10
votes
4answers
16k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
-1
votes
2answers
34k views

EXE to C source code decompiler [duplicate]

Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
9
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
4
votes
1answer
818 views

Protect a key from being recovered by decompilation

I work in a game editor that develop an online game. In our endless struggle against bots (that have negative impacts on server performances, game economy, game experience, ...), one of ours weapons ...
2
votes
0answers
57 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
2
votes
1answer
135 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
8
votes
2answers
8k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
2
votes
3answers
952 views

How to get resource in swf file?

I use this site http://www.showmycode.com/ to decompile the swf below http://kwcdn.000dn.com/swfs/8b/23440heisesm/bg.swf But the code only shows the link for a video but I can not get the image in ...
1
vote
2answers
936 views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
10
votes
4answers
14k views

AirPlay Mirroring decryption (FairPlay)

I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
0
votes
1answer
1k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
1
vote
0answers
316 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
1answer
1k views

R.java to xml file

How does R.java work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used apktool to extract ...
1
vote
1answer
1k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
2
votes
1answer
420 views

File Type - VCDIFF binary extract

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and ...
1
vote
1answer
82 views

Signed/unsigned representation of ints in decompiled code in Hopper

Hopper allows you to change the representation of numbers in the disassembly window so that: 0000be84 str r3, [r11, #0xfffffff0] becomes: 0000be84 str r3, [r11, #-0x10]...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
0
votes
1answer
152 views

COM file starting point

I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the ...
7
votes
2answers
5k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
1
vote
0answers
1k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
2
votes
1answer
2k views

Deobfuscating IDA Pseudocode

I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro. ...
4
votes
6answers
7k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
2
votes
2answers
9k views

Legality of Decompilation [duplicate]

How "legal" is it to read and edit .exe files, .dll files, and other compiled source files? Decompilation is taking the compiled code of a program, often minified and obfuscated, and trying to get the ...
4
votes
2answers
11k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
0
votes
3answers
1k views

Is this just junk?

I have some decompiled code using Hex Rays. I can see that there is a memory copy operation but I am lost in what the code is trying to do after that with calls such as _floatsidf. What is this code ...
2
votes
0answers
220 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
3
votes
3answers
1k views

Transformation of assembly code into C language (decompilation)

I have the following assembly code and I wanted to transform it into the C language. During the transformation, I had some question for which I could not find any answers. So, here is it: ...
2
votes
1answer
884 views

IDA PRO and Dos Load Exec

I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace? It has already ...
3
votes
1answer
3k views

How to edit an executable's “.data” segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
5
votes
2answers
1k views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
8
votes
1answer
3k views

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

When I decompile using IDA PRO I get code which could look like both of these Understanding the __PAIR__ macro. Macro itself. // The following definition is not quite correct because it always ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...