Questions tagged [decompile]
Process of translating an unstructured assembler program into a structured high-level language program (e.g. translation from x86 to C).
68
questions
2
votes
1answer
121 views
How to prevent Ghidra from removing unreachable blocks?
I am using this extension for loading PS-X executables:
https://github.com/lab313ru/ghidra_psx_ldr
During decompilation, Ghidra shows some of these warnings:
WARNING: Removing unreachable block (...
-1
votes
1answer
62 views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
1
vote
2answers
119 views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
2
votes
1answer
212 views
Decompiling .pyc file to 0 byte .py file
i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte
The original file'...
-1
votes
1answer
48 views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
2
votes
1answer
73 views
Invalid file path error while trying to rebuild with apktool and aapt2
I am facing an error while try to repack an apk with apkool. below is the error trace.
W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'.
W: error: invalid file ...
0
votes
0answers
132 views
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
-1
votes
1answer
50 views
How to decode a .plr file
I have a .plr file that contains all of the player information for the game Terarria.
I would like to decode it to have a look at what data is stored on this file so that I can play around with making ...
1
vote
1answer
89 views
Reverse Engineering Java - Deobfuscating symbols
I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example:
import org.lib.00.0.2;
public final class 90
...
0
votes
1answer
71 views
“check:” keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
0
votes
0answers
93 views
How can I get classes from “protected” JAR file?
I'm trying to get classes from JAR file / actually running JVM machine but:
When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.
...
1
vote
1answer
204 views
Decompiling Python Files: ValueError
So I have this python file and I successfully unpacked its content inside of it we have our file.pyc
I appended the magic bytes to it so it went from:
E3 00 00 00 00 00 00 00 00 00 00 00 00
to ...
-1
votes
1answer
49 views
How to find where a subroutine is being called (ida)
I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
-2
votes
1answer
766 views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
1
vote
1answer
143 views
Need to decompile executable from Openwrt ELF 32-bit
what best tool to use to decompile executable from Openwrt image
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ?
...
1
vote
2answers
238 views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
0
votes
2answers
187 views
Hex-Rays skips code
have using IDA Pro 6.8 (Hex-Rays 2.2), default settings.
Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
0
votes
0answers
67 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
1
vote
0answers
49 views
(Help) APK Decomplied unreadable .pngs
I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
1
vote
0answers
311 views
Turning p-code generated by VBA (Visual Basic for Applications) back into VBA
According to the README in https://github.com/bontchev/pcodedmp :
"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"
"when you open the source of a macro ...
0
votes
1answer
171 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
7
votes
0answers
319 views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
2
votes
0answers
167 views
How should I got about working out the format for this psp game?
I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
0
votes
1answer
486 views
Android Reverse Engineering Network Traffic Stack Trace
Lets say an Android application sends out a traffic out to the server and expects a Json Response
Request:
https://server:port/userid=user1&token=randomstring7345
We want to replicate the ...
2
votes
1answer
785 views
How to override c++ string class with LD_PRELOAD
i am trying to override predefined functions such as strcmp, getenv, etc.
i already override some of them using LD_PRELOAD options.
but i can't override string class, how can i override c++ string ...
1
vote
1answer
1k views
Decompile a DLL file from Microsoft Media Creation Tool
In this Superuser topic Windows 10 Media Creation Tool, how does it work?, it is possible to extract the URL from SetupMgr.dll. My question is, how do I extract this URL from SetupMgr.dll? I want to ...
0
votes
1answer
207 views
Reversing C# exe,Questions.Help
I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second.
I want to rewrite its dataseries before the new data comes with my own dataset.
...
5
votes
1answer
761 views
Erlang Source file generation from .beam file
I have Erlang application's beam files which I want to decompile.
Application is Compiled and build with 'debug_info' options. here is snippet of emake file to which is used to build application :
{...
3
votes
0answers
215 views
What tool is able to analyze/decompile asm execution trace?
I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).
I ...
1
vote
1answer
45k views
Can we decompile an .exe or .dll as %100? [closed]
Can we decompile a .exe or .dll file as 100%? Also sometimes seems some
mistakes on somewhere (like mainfrm.cs) , how can we fix that?
What is the best .NET decompiler? or What would you prefer?
I ...
0
votes
1answer
670 views
Reverse engineer the update-binary file in Android recovery update packages
I am trying to understand how to disassemble or at least get a readable copy of the update-binary file located in /META-INF/com/google/android/. It is a modified version for a smartwatch, which ...
0
votes
1answer
839 views
I'd like to ask about unpacking aspack 2.12
I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
1
vote
1answer
863 views
How to assemble back a disassembled ChunkSpy LUA?
Is it possible to assemble back the ChunkSpy's dissembled LUA files? Here's an example:
0B50 05000000 [001] getglobal 0 0 ; script
0B54 C63E0000 [002] gettable 0 0 ...
2
votes
1answer
3k views
Decompiling 64bit ARMv8 Android .so library
I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
0
votes
0answers
453 views
Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?
Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
0
votes
1answer
62 views
Decompiling or Feature to Help Reverse FPU Instructions?
I've been running into a lot of FPU instructions from an old program I am trying to reverse engineer. It tends to be rather difficult to reverse when there is a huge section of FPU instructions, just ...
0
votes
0answers
115 views
Reassemble function that has its control flow chopped so that it can be decompiled by IDA
I try to decompile a function that is obfuscated by having split
up the controlflow into asmblocks scattered around the .text section
and connected by "jmpq" jumps.
<func1>:
0: insn..
1: ...
1
vote
2answers
619 views
Dlink DIR 600M firmware decompile issues
How to decompile the CGI & ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing.
NOTE: Its not the same as DIR 600
...
3
votes
5answers
42k views
Recover source code for C# .exe
I paid a freelancer programmer for an app to tun my clinic. He got about 95% of the project done, but then got a job elsewhere and vanished into thin air, along with my source code... So, I have a ...
1
vote
1answer
683 views
I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?
I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...
1
vote
1answer
935 views
Android - Analyzing complex hash algorithm
An APK I'm working on uses some sort of algorithm to generate a hash which is sent along with an HTTP request. I want to figure out how the algorithm works.
Decompiling the APK to Java is of no help ...
0
votes
1answer
2k views
Extracting a .DAT file
I want to extract a chunk of text available in an android app.
I disassembled the APK and found a .DAT file which seems to carry the text I'm looking for (the file was inside the directory res/raw/).
...
1
vote
2answers
16k views
How can I decompile an ARM Cortex-M0 .hex file to C++?
The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
7
votes
2answers
2k views
How to retrieve native asm code from .NET mixed mode dll file?
This is seriously one question I couldn't find the answer to anywhere on Google.com
When I mean mixed mode I mean .NET application which has unmanaged and managed code together.
I used tools
.NET ...
-1
votes
3answers
1k views
ida decompiler output
double __cdecl sub_401660(float a1)
{
double v1; // st7@1
float v2; // ST00_4@1
float v4; // [sp+8h] [bp+4h]@1
float v5; // [sp+8h] [bp+4h]@1
v1 = a1;
LODWORD(v2) = 0x5F3759DF - (SLODWORD(...
0
votes
1answer
2k views
Decompiling/Unpacking a Compiled/Packed File (Or Somehow Inserting a Flag)
I'm using a program that can pack/compile a folder with files into a single *.xyz file that only that program can decompile and read. In order for the program to create a compiled file the flag:
[...
3
votes
0answers
2k views
Can IDA generate C code for ASM assembly wihtout the binary
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
2
votes
0answers
395 views
Jar reversing: Can't open as zip file nor open it with common decompilers
I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.
So after running JD-...
0
votes
1answer
111 views
Can Reverse Engineering produce code in a different language than the one the program was originally created?
Does Reverse Engineering always produces the source code in the same language the software was originally written?
For example, if the software program(.exe) been reversed was written in C++, the ...
2
votes
2answers
573 views
What does this combination SCAS and STOS?
I have a simple snippet with several instructions:
01: mov edi, [ebp+8]
02: mov edx, edi
03: xor eax, eax
04: or ecx, 0FFFFFFFFh
05: repne scasb
06: add ecx, 2
07: neg ...
