Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

Filter by
Sorted by
Tagged with
-3
votes
1answer
369 views

What are the risks of running a decompiler? [closed]

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb. I've searched and ...
4
votes
2answers
7k views

Workflow patching Java jar file

Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch. With ...
7
votes
2answers
875 views

IL for decompiler to human-readable format

After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example push ebp mov ebp, esp sub esp, 10h mov eax, ...
2
votes
1answer
3k views

Stronger than Themida?

I am new to reverse engineering and file protections. I have made a trading algorithm for Tradestation that I have put into a C++ DLL instead of having the source laying around, and I want to protect ...
0
votes
1answer
104 views

Understanding pseudocode containing a math operation in a variable assignment [closed]

So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. The code in particular iterates through every byte of the encrypted file, ...
0
votes
1answer
147 views

Windows PKZIP encryption / compression calls might be altering password?

I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file... basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,...
2
votes
1answer
196 views

How to locate the code used for encryption

I've been playing around with recording packets being sent to and from applications on my pc. Logically any program that sends or receives packets must have the encryption scheme used. So I'd like to ...
0
votes
1answer
4k views

How to decompile python [duplicate]

How can I decompile python 3.3 files ?? Can you please suggest me a tool for linux ubuntu 14.10 in specific note easy decompiler didn't work for me :(
5
votes
1answer
1k views

Coalesce Enums in IDA?

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums? For instance, I have the following enums, HTTP_QUERY_CONNECTION has the value 23 and ...
3
votes
1answer
13k views

what's the function of LODWORD and HIDWORD?

I'm trying to figure out what does this piece of code exactly: LODWORD(fMax) = *(_DWORD *)v12; HIDWORD(fMax) = v13; I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
12
votes
4answers
19k views

Recovering .NET sources into full blown project

I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'...
-1
votes
2answers
37k views

EXE to C source code decompiler [duplicate]

Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
9
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
4
votes
1answer
825 views

Protect a key from being recovered by decompilation

I work in a game editor that develop an online game. In our endless struggle against bots (that have negative impacts on server performances, game economy, game experience, ...), one of ours weapons ...
2
votes
0answers
60 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
3
votes
1answer
141 views

Connecting a Motion Simulator to GTA

I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
8
votes
2answers
9k views

How to extract functions from one executable to include/link in another

I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled ...
2
votes
3answers
1k views

How to get resource in swf file?

I use this site http://www.showmycode.com/ to decompile the swf below http://kwcdn.000dn.com/swfs/8b/23440heisesm/bg.swf But the code only shows the link for a video but I can not get the image in ...
1
vote
2answers
1k views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
10
votes
4answers
15k views

AirPlay Mirroring decryption (FairPlay)

I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
0
votes
1answer
2k views

Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?

I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
1
vote
0answers
328 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
1answer
2k views

R.java to xml file

How does R.java work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used apktool to extract ...
1
vote
1answer
2k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
2
votes
1answer
447 views

File Type - VCDIFF binary extract

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and ...
1
vote
1answer
82 views

Signed/unsigned representation of ints in decompiled code in Hopper

Hopper allows you to change the representation of numbers in the disassembly window so that: 0000be84 str r3, [r11, #0xfffffff0] becomes: 0000be84 str r3, [r11, #-0x10]...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
0
votes
1answer
156 views

COM file starting point

I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the ...
7
votes
2answers
6k views

GUI for transforming Java Bytecode based on decompiled source?

Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists: What I'm thinking of ...
1
vote
0answers
2k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
2
votes
1answer
2k views

Deobfuscating IDA Pseudocode

I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro. ...
4
votes
6answers
7k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
2
votes
2answers
10k views

Legality of Decompilation [duplicate]

How "legal" is it to read and edit .exe files, .dll files, and other compiled source files? Decompilation is taking the compiled code of a program, often minified and obfuscated, and trying to get the ...
7
votes
2answers
13k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
0
votes
3answers
1k views

Is this just junk?

I have some decompiled code using Hex Rays. I can see that there is a memory copy operation but I am lost in what the code is trying to do after that with calls such as _floatsidf. What is this code ...
2
votes
0answers
221 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
3
votes
3answers
1k views

Transformation of assembly code into C language (decompilation)

I have the following assembly code and I wanted to transform it into the C language. During the transformation, I had some question for which I could not find any answers. So, here is it: ...
2
votes
1answer
952 views

IDA PRO and Dos Load Exec

I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace? It has already ...
3
votes
1answer
4k views

How to edit an executable's “.data” segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
5
votes
2answers
1k views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
8
votes
1answer
3k views

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

When I decompile using IDA PRO I get code which could look like both of these Understanding the __PAIR__ macro. Macro itself. // The following definition is not quite correct because it always ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
-3
votes
1answer
1k views

objective-c: getting source code from binary [duplicate]

I posted a question a few time ago but answers were not clear to me and the topic was closed because apparently the request was not clear: SO I clarify it: One upon a time a wrote a obj-c app but now ...
2
votes
2answers
2k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
3
votes
2answers
1k views

Can someone tell me what this memcpy or maybe it's a memset? looks like a memset, rep movsd and rep movsb This is a packet sending function

Trying to understand a function thats responsible for sending out a packet. I don't understand could it be a integer array or something? or some inline function that's not properly getting rendered in ...
2
votes
1answer
1k views

C What kind of sorting algorithm is this?

I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow I just don't know which one it ...
41
votes
1answer
85k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
6
votes
2answers
1k views

Understanding x86 C main function preamble created by Visual C++

I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program. To illustrate what I ...
9
votes
5answers
9k views

Decompilation techniques for DOS .COM files

I've found a binary copy of a DOS freeware game I was fond of back in the day (Firefighter, downloadable as FIRE.COM) but the source code is not available. I'd like to re-implement it in C or Python ...

1
3 4 5
6
7