Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
2
votes
1answer
2k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...
3
votes
1answer
533 views

reverse engineering legal?

Few weeks ago, I started reverse engineering libraries and binaries from a commercial copyrighted product (game). And, I would like to post the code on an open source platform like Github. I've ...
0
votes
1answer
528 views

Converting assembly function to c

I have the following function in assembly, and i'm trying to convert it to c. the function accept 2 parameters, the first one is char* and the second is the int this is the assembly code: 71D3C400 ...
2
votes
1answer
159 views

Unknown variable from asm code

During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8 function check_password(arg0) { var_18 = *0x28; //stack checksum? if (parse_cereal(var_D0, ...
1
vote
1answer
252 views

IDA Hex-Rays Generating Redundant Code

Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process. if ( v1 ) { v15....
3
votes
1answer
1k views

Wapiflapi reverse engeneering exercices

Right now I'm trying to solve r5 from here I've already tried to understand pseudo-code from Hooper function check_password { var_28 = arg0; if (strlen(var_28) != strlen("...
2
votes
2answers
1k views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
3
votes
1answer
2k views

What are the steps, to extract an unknown archive file in this case?

I've never did something like this before, but I have programming experiences. There are two files: data00.big and data01.big, which I would like to extract. I've tried Dragon Unpacker, which can ...
4
votes
6answers
8k views

Are there any interactive decompilers besides HexRays?

Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or ...
1
vote
1answer
7k views

Hex Rays - strange functions __ROL4__ and __ROR4__

What's purpose of functions ROL and ROR? For both of them, first arg is int, and second is byte I suppose that's bitwise shifts ]1s]2
0
votes
1answer
614 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
3
votes
1answer
670 views

Reverse engineering Android device framework

I'm trying to get to an Android device framework source to perform static analysis on it. I'm specifically looking at a Samsung Galaxy S6 device with Android 5.1.1. I downloaded the firmware image, ...
4
votes
2answers
8k views

Mapping Android resource IDs to resource string

I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to ...
1
vote
0answers
165 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
0
votes
1answer
419 views

Obtaining the argument text from a carg_t IDA Python object

I have a decompiled result from calling idaapi.decompile(). From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of ...
2
votes
1answer
949 views

Obtaining the Pseudocode of a function via a script

I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan). I did locate this documentation on using the decompiler in batch mode: ...
1
vote
1answer
2k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
0
votes
1answer
3k views

Issue decompiling c# method

I'm trying to decompile a c# dll and on a particular method I'm getting this result public IEnumerable<Guid> GetDbIdentifiers(int classId) { switch ((794999935 == 794999935) ? 1 : 0) { ...
1
vote
1answer
181 views

Does empty enumeration in C structure creates unnamed field?

I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header): struct S { enum {EN0, EN1}; int m1; } ; ...
0
votes
2answers
666 views

Ida Pro Decompiler Plugin producing way too few lines of code?

Im reverse engineering a Games Entity System from scratch. I found a function that initializes some sort of descriptor, it looks up a given property name in a huge array and initializes the structure ...
-2
votes
1answer
374 views

Help Coverting ASM to C [closed]

I need assistance decompiling the following from ASM to pseudo C. Code 1 ... mov edx, Var1 # Move Var1 to edx mov ecx, Var2 # Move Var2 to ecx mov eax, edx # Move EDX (Var1) to EAX ...
-1
votes
1answer
568 views

Reverse engineering of executable code

I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the ...
1
vote
1answer
206 views

KeygenMe - My output has one wrong character

I'm trying to get into reverse engineering and am beginning with .NET, attempting various CrackMes and KeygenMes that I've found on the internet. Until now, I haven't really struggled but this latest ...
0
votes
3answers
345 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
0
votes
1answer
419 views

Exe Unpack or Process Spy - Getting process internals

I want to rewrite a application tool in C# that is written in VB6. This application does not work in windows 8/10 due to some compatibility issues. It is an old game server management tool. This ...
0
votes
1answer
81 views

Trying to locate activator for function

I have been looking through a video games executable trying to find the values or variables in order to make a dev tool for real time editing. I have tried to trace the references back to maybe .float ...
2
votes
1answer
22k views

Extract text data from a compressed/encrypted .DAT file

Hello, I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is ...
1
vote
1answer
804 views

How to display only the IR for your program code

I have a simple C program that is literally int main(void) { return 0; } When I convert this to assembly, gcc -S, it grows to around 10 lines. As expected. Then when I convert it into binary, and ...
1
vote
0answers
578 views

Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE] [closed]

I am already aware of the question: 'Reverse Engineering program written in Python, compiled with “freeze”' I have Immunity Debugger and is this the pyc code and the structures? When I run the ...
0
votes
1answer
864 views

Global C++ classes/variables, strange initialisation

I apologise for the length of this post, though I have taken the time to make it as readable as I can and included my ideas and thinking where possible so this post might be useful to other readers ...
0
votes
2answers
5k views

How to decompile this assembly code? [closed]

How can I convert the following IDA Pro generated disassembly (assembly language) into a higher level language? ... mov edx, Var1 mov ecx, Var2 mov eax, edx imul ecx mov edx, eax imul edx, eax mov ...
1
vote
2answers
992 views

Find a string in an object file

I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/...
1
vote
1answer
98 views

Decompiling, changing, compiling and using a program which can damage my computer

I need to change a program which updates firmware on a computer. I want to decompile it, make changes in it, then compile it and use it for updating my computer's firmware. I wonder if it is possible ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
1answer
1k views

Decompiling a windows 3.1, VisualBasic 3 exe. Do I need to decompile dll too? How?

New to decompiling, and code generally. Trying to decompile a windows 3.1 game (text adventure), so I can build it up again. Because at the moment it doesn't work (even on windows 3.1). I decompiled ...
1
vote
1answer
3k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
0
votes
1answer
250 views

Mapping a high level statement back in assembly dump

Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
4
votes
1answer
1k views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
1
vote
0answers
143 views

Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011

I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error "out of ...
0
votes
1answer
145 views

Does anybody know which tools allow to get (pseudo) code from a Moscow ML executable?

I've decompiled Win32 executable that is the result of compilation of a program written in Moscow ML language. The resulting listing contains standard C main function that contains the call to ...
-1
votes
1answer
245 views

Reversing a function, methodology

Which are the methods or which are the steps for from a asm disassembled function code passing/converting it to 'C/C++' or other language and tell what happens.
2
votes
1answer
2k views

Assistance in Decrypting Lua script that is obfuscated with Base64 > SSL

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? Basically they are encoded with Base64 then SSL, but I have no idea how to ...
-4
votes
1answer
2k views

Is it possible to decompile the password protected rar file? [closed]

I'm trying to crack winrar's password using some methods as explained below. Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years. But, if we ...
1
vote
1answer
182 views

Getting Encryption Method When I Know Encrypted File Name & Original File Name

I'm busy trying to decrypt some game data. All the encrypted filenames are hexadecimal strings with the same length e.g. 1790C6E445C7E38EFCD5B3042F9B4443. I've figured out that a few of the files ...
3
votes
1answer
7k views

What is the meaning of *(_DWORD *)

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. for ( i = 0; i < 6; ++i ) { v7 = (int)&val_253; for ( k = 1; k < ...
1
vote
1answer
170 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
1
vote
0answers
792 views

Extract resources from compiled “resource file”

I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code ...
1
vote
1answer
113 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
1
vote
1answer
688 views

Help with analysis from IDA Pro Hex-Rays dump

I'm trying to reverse-engineer a file format, and I got a buddy of mine (who works in the security field) to decompile the program via Hex-Rays and give me the resulting .C file. I've spent the past ...

1
3 4
5
6 7