All Questions
Tagged with decompile or decompilation
602 questions
1
vote
0
answers
53
views
Reconstructing Source Code for a scratch-built GIS system
I have a new client who wants to move their GIS platform support to a new vendor. The only problem is the outgoing vendor of 15 years does not want to release the source code. My client made a ...
- 11
1
vote
2
answers
73
views
What is CARRY2 in Ghidra?
I decompiled a 16-bit Windows 3.1 program with Ghidra 11.0.3 and part of it looks like this:
if ((uVar6 = local_8 + local_a + 0xa46b, uVar6 + local_10 == -0xded &&
((uint)CARRY2(local_8,...
- 111
0
votes
0
answers
27
views
Extracting sounds from Conflict Global Storm SCHs
What is .sch from Conflict Global Storm and are there programs that can handle this file format, and what is the memory address for the sound function?
https://drive.google.com/file/d/...
0
votes
0
answers
47
views
Extracting music from APK file NOT working
just trying to extract music from a game called Mini TD 2.
I extracted the folder using apktool and searched for the terms: mp3, ogg, wav, music, media, song and I didn't find any music files used in ...
- 101
0
votes
0
answers
17
views
How to find the native library for a specific native method in android Java code?
I am having a function in an apk that looks like this:
I want to find the .so file that contains executable code for this function.
What I tried:
I tried looking for calls to System.loadlibrary() in ...
3
votes
1
answer
104
views
Could a decompiler give better results if provided with part of the original code?
I know it's generally impractical to decompile programs written in C/C++ and the like because most non-essential information is lost during the translation to machine code. Any decompiled code would ...
- 133
0
votes
0
answers
36
views
Reverse Engineer a RC ECU
I am looking to reverse engineer and access hidden menus within a RC airplane ECU.
I have decompiled the code using Ghidra, for the desktop app and can see where the menus I am trying to access are, ...
- 1
0
votes
1
answer
76
views
C# reverse engineering bypass obfuscation
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I managed ...
0
votes
1
answer
51
views
Ghidra user scripts location
Ghidra: what is default location (path) for custom scripts? Same question for custom .fidb files.
- 235
0
votes
0
answers
135
views
Extract flag from .exe file
I have to extract a flag from a test.exe file. The respective flag is run as an argument for the test.exe file => "test.exe FlagName" and in this way I will reach the next flag.
I ...
0
votes
0
answers
75
views
Help to identify intermediate language
I have scripts written in PineScript, TradingView's proprietary DSL. Ultimately, Pinescript code gets translated to an intermediate language (IL) presentation, below is an example:
PineScript
//@...
- 1
1
vote
2
answers
79
views
How to find what are all the third party apps used in an android app manually by decompiling an apk
How to find all the Third Party Libraries (TPLs) used in an android app after de-compiling apk using jadx? I have looked at this answer but this is too vague.
I can use tools such as Libradar etc. but ...
- 13
2
votes
2
answers
82
views
What's the best way or approach to debug binary Linux library?
I've got a header file (I know the functions and have some documentation) and a .so file:
From a wrapper library and from context, I need to call "Connect", but it does not work, just fails ...
1
vote
1
answer
151
views
Kawai ES110 - Firmware supplied as MIDI file, what can we do?
The firmware for this digital piano is supplied as a MIDI file with an EasyPlayer.exe (not sure if Wine can run this properly) binary to upload it.
I'm wondering if there's a way to get at it's ...
- 113
0
votes
0
answers
43
views
Find Dereference And Write to Offset of Pointer
I want to find objects within a large C++ codebase that have a function that writes to 16 bytes offset off a pointer stored in an instance variable.
So for example given the code has:
MyClass object1 =...
- 11
0
votes
0
answers
44
views
Stuck on trying to understanding local TCP communication for a smart home app
I am trying to write a Home Assistant integration to control smart lights and other smart devices from a certain manufacturer locally (it is a local manufacturer who have their own app which is not ...
0
votes
0
answers
78
views
Make a reverse engineering for dead app
Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
0
votes
1
answer
57
views
Is there any way to read the data in STC11F02E?
I need to read the data from the STC11F02E microcontroller. Is there a way to do this?
- 1
1
vote
1
answer
95
views
Reverse engineering AES128 Key Derrivation from MAC Address
Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped.
From this decompilation I ...
- 11
1
vote
1
answer
108
views
Tips for reverse engineering Common Lisp (SBCL) ELF binary
I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
- 111
2
votes
1
answer
184
views
How to decrypt Zyxel's 'Backup_Restore' config file?
I have a VMG3625-T50B running an ISP-dedicated firmware version (V550ABTL0b2r). I managed to get the supervisor password yet I can't enable open an SSH port because my SP disabled that option.
I've ...
- 21
1
vote
1
answer
89
views
Get the jar from exe4j executable
I've read this question and it is not a duplicate to mine. I have a .exe file which has different contents inside when opened with 7zip. However let's say I know that it uses EXE4J, how can I ...
0
votes
0
answers
91
views
Decompiling very heavily obfuscated JAR
I have a very very obfuscated jar. I tried using Krakatau and CFR and it won't decompile. With CFR some of the important classes / methods fail to decompile and with krak it says it is writing data to ...
- 1
1
vote
0
answers
32
views
wWinMainCRTStartup and wWinMain are filled with uninitialized memory
I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
- 11
0
votes
0
answers
93
views
Deobfuscating WPF obfuscated code
The project uses WPF : What should i do for XAML links de4dot supporting that ?
I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
- 1
0
votes
0
answers
61
views
Attempting to auto reverse XOR
Does anyone know of any helpful tools or a way to automate decryption of XOR in IDA? I know that they have a built in function to do some bare XOR encryption but this one seems a bit more ...
0
votes
0
answers
78
views
Resizing variables to improve decompilation results
Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results:
As you can see, we have what ...
- 101
0
votes
0
answers
60
views
Is there a way to access the background calculation & data in a .exe coded in fortran 30+ years ago?
The company I work for has an ancient (circa 1989-1992) program coded in Fortran that is used for sizing and selecting some of our products. We are going through a modernization project with the goal ...
- 1
0
votes
0
answers
67
views
Decompile or analyse injected /usr/bin/cat
I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable.
Need some tips as a beginner how to find the injection method if it'...
0
votes
1
answer
164
views
APK/Apktool If I decompile and recompile sources the app does not start
I'm trying to reverse an apk but there is a strange thing that happens, probably something new for me, basically if I decompile only the resources (not dex files) and recompile it zipalign/sign, the ...
- 1
0
votes
0
answers
122
views
Reverse engineering Objective-C blocks
I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
1
vote
0
answers
84
views
Freeware x86 decompilers for Windows with debug? [closed]
I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables.
That above was a quick ...
- 111
0
votes
1
answer
392
views
i need software to decode this subtitle xml file, anyone know what it encodes with?
This is a subtitle file encoded by xml, is there any way to decode this xml file to srt?
Subtitle link xml
1
vote
0
answers
308
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
0
votes
1
answer
103
views
Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing
Goal:
Trying to reverse encrypter to decrypter that successfully decrypts.
This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
-3
votes
1
answer
2k
views
Is it possible to decompile ex5? What are some hints in how one would do so?
I am creating an expert advisor. I am wondering how people can decompile the ex5 to mq5 for meta trader. Does anyone have any insight on this?
- 95
0
votes
1
answer
108
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
2
votes
1
answer
164
views
How to define a 28-bit integer in Ghidra
I'm working on reverse-engineering firmware for an STM32G0B1, which has two onboard CAN modules, in Ghidra.
I think that a proper data structure for both the Tx and Rx FIFO buffers would help me ...
- 121
0
votes
1
answer
4k
views
What are some methods to reverse a ex5 file for metatrader 5?
What are some methods to reverse a ex5 file, for metatrader 5? I would like to understand how people crack ex5 files and make them for use. Any ideas of reverse engineering tools for this scenario?
- 95
2
votes
0
answers
60
views
How to find where an instance variable of some object is set to some concrete value?
I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
2
votes
1
answer
250
views
How to map a decompiled c program back into original source code
I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).
So is ...
- 39
1
vote
0
answers
86
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
2
votes
0
answers
109
views
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.
Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
- 21
5
votes
1
answer
247
views
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
- 191
2
votes
1
answer
105
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 21
3
votes
1
answer
244
views
IDA Decompiler generates wrong output on array of structures!
There is a structure with size of 16-Bytes, and an array of it is defined.
The disassembly code for navigation through the array is:
MOV i, i,LSL#4
LDR R4, =arr_of_struct
ADD i, i, R4
LDR ...
- 161
4
votes
2
answers
648
views
How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?
Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines?
MOV R1, #100 -> MOV R1, #(5 * 20)
LDR R8, =var | ...
- 161
4
votes
3
answers
599
views
Help disassembling a simple 16-bit NE function
I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required.
I would assume ...
- 165
2
votes
0
answers
261
views
1
vote
0
answers
34
views
Santander US - app
I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. ...
