Questions tagged [decompile]
Process of translating an unstructured assembler program into a structured high-level language program (e.g. translation from x86 to C).
93
questions
1
vote
0
answers
95
views
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)
My Assembly code looks like this:
.global _start
_start:
...
- 23
0
votes
0
answers
41
views
How to Add Custom Functions to a Dynamic Library
There is a dynamic library elf/so in which I rewrote several functions to the ones I needed
(using the id pro, I wrote my functions in place of the original ones - which are not needed).
Now I need to ...
0
votes
0
answers
31
views
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
- 723
0
votes
0
answers
17
views
How to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface?
Is there any tool to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface?
example code:
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
delegate void ...
- 101
0
votes
0
answers
43
views
Malware analysis of undetected NodeJS token grabber
I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'.
Someone contacted me asking to playtest a game, which prompted a .exe file.
I ran the file and website on ...
2
votes
2
answers
93
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 451
5
votes
1
answer
3k
views
Decompile a NodeJS compiled program maybe by NEXE
I recently got idiotly scammed one of my discord account but kept the malware in case.
Curious, I would love today to break into the executable to fetch any information about the scammer.
I decompiled ...
- 51
0
votes
0
answers
72
views
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
- 146
0
votes
0
answers
185
views
Convert Arm64 Assembly Trace To C
I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format.
I've already ...
- 101
0
votes
1
answer
126
views
uncompyle6 gives success message but output is not readable
I am trying to use uncompyle6 to decompile a .pyc code. I even tried --verify option. It says
Successfully decompiled file
but the output only contains strings like \xe0\xb3\x0bh\x90.
What should I ...
- 1
2
votes
2
answers
216
views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
- 21
1
vote
0
answers
143
views
Decompiling dll file to extract a function (subroutine)
I have a university project, and my professor gave me a DLL file which I need to extract a subroutine from, and it is not clearly defined as a subroutine. The purpose is to translate the code to C++ ...
- 111
0
votes
0
answers
115
views
extract file from a compiled java exe
I've an exe compiled with nexe and I want to extract file .
I can see all the source code with a Hexviewer but it is a shame to extract each file.
I've extract 95% of the source code but I miss some ...
0
votes
0
answers
214
views
Decompiling exe to python source code
I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part:
--- This ...
- 1
1
vote
0
answers
134
views
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
4
answers
346
views
Are there any 64 bit MIPS decompilers
I’ve found many mips 32 bit decompilers. I’m trying to decompile a simple 64bit elf from mips to c. Ida doesn’t seem to have much of a problem with disassembly. After some fixings I tried the ...
1
vote
0
answers
66
views
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :
UmdUsFrEB3wGMuuAz1Znywuedx6+...
- 11
0
votes
0
answers
125
views
How do I decode or decompile this class It seems codes are encrypted?
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.
Code:
public ...
1
vote
1
answer
95
views
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
- 13
1
vote
1
answer
494
views
ghidra rename fails
With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L.
Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
- 123
1
vote
0
answers
220
views
Right way to reverse a VM
I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
- 345
1
vote
1
answer
3k
views
How can I modify or decompile Hermes JS bytecode?
Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode.
The Hermes documentation mentions hbcdump ...
- 113
0
votes
0
answers
1k
views
Reverse exe file compiled by pyinstaller
I am trying to get python source code from only exe file compiled by pyinstaller.
I used the pyinstxtractor.py and got extracted folder.
And then what or how should I do?
Or could you explain other ...
- 101
-2
votes
1
answer
235
views
How to deobfuscate Java application protected by Java Antidecompiler [closed]
Here is some infomation I found from MANIFEST.MF
Archiver-Version: Plexus Archiver
Built-By: boonb
Created-By: Apache Maven
Build-Jdk: 1.8.0_231
Main-Class: JavaLauncher
Modified-By: 9.4 (BIS Guard &...
- 1
0
votes
1
answer
53
views
what means "ilegal use of registers"?
I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000":
What is in the pe program reader:
And is this what i see on the debugguer :
3
votes
1
answer
1k
views
How to prevent Ghidra from removing unreachable blocks?
I am using this extension for loading PS-X executables:
https://github.com/lab313ru/ghidra_psx_ldr
During decompilation, Ghidra shows some of these warnings:
WARNING: Removing unreachable block (...
- 239
-1
votes
1
answer
363
views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
- 126
1
vote
2
answers
289
views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
- 126
3
votes
1
answer
3k
views
Decompiling .pyc file to 0 byte .py file
i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte
The original file'...
- 33
-1
votes
1
answer
95
views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
- 31
2
votes
1
answer
254
views
Invalid file path error while trying to rebuild with apktool and aapt2
I am facing an error while try to repack an apk with apkool. below is the error trace.
W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'.
W: error: invalid file ...
- 179
0
votes
0
answers
733
views
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
- 13
-1
votes
1
answer
156
views
How to decode a .plr file
I have a .plr file that contains all of the player information for the game Terarria.
I would like to decode it to have a look at what data is stored on this file so that I can play around with making ...
1
vote
1
answer
294
views
Reverse Engineering Java - Deobfuscating symbols
I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example:
import org.lib.00.0.2;
public final class 90
...
- 103
0
votes
1
answer
170
views
"check:" keyword in Ghidra
I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
- 3
1
vote
1
answer
509
views
How can I get classes from "protected" JAR file?
I'm trying to get classes from JAR file / actually running JVM machine but:
When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.
When ...
- 13
1
vote
1
answer
3k
views
Decompiling Python Files: ValueError
So I have this python file and I successfully unpacked its content inside of it we have our file.pyc
I appended the magic bytes to it so it went from:
E3 00 00 00 00 00 00 00 00 00 00 00 00
to ...
- 31
-1
votes
1
answer
83
views
How to find where a subroutine is being called (ida)
I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
- 3
-2
votes
1
answer
4k
views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
- 61
1
vote
1
answer
633
views
Need to decompile executable from Openwrt ELF 32-bit
what best tool to use to decompile executable from Openwrt image
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ?
...
- 11
1
vote
2
answers
655
views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
- 1,748
1
vote
2
answers
736
views
Hex-Rays skips code
I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings.
The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
- 11
0
votes
0
answers
147
views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
- 101
1
vote
0
answers
75
views
(Help) APK Decomplied unreadable .pngs
I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
- 11
1
vote
0
answers
920
views
Turning p-code generated by VBA (Visual Basic for Applications) back into VBA
According to the README in https://github.com/bontchev/pcodedmp :
"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"
"when you open the source of a macro ...
- 11
0
votes
1
answer
345
views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
- 204
7
votes
0
answers
502
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 71
2
votes
0
answers
261
views
How should I got about working out the format for this psp game?
I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
- 21
0
votes
1
answer
837
views
Android Reverse Engineering Network Traffic Stack Trace
Lets say an Android application sends out a traffic out to the server and expects a Json Response
Request:
https://server:port/userid=user1&token=randomstring7345
We want to replicate the ...
2
votes
1
answer
1k
views
How to override c++ string class with LD_PRELOAD
i am trying to override predefined functions such as strcmp, getenv, etc.
i already override some of them using LD_PRELOAD options.
but i can't override string class, how can i override c++ string ...
