All Questions
Tagged with decompilation c
49 questions
0
votes
1
answer
108
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
3
votes
1
answer
149
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 31
2
votes
1
answer
113
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
2
votes
1
answer
2k
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
1
vote
1
answer
221
views
Python or C for a Qt application and security against reverse engineering
I actually have two choices : C or Python to create my application.
On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
- 113
1
vote
1
answer
434
views
Custom IDA Decompilation Coloring
Is there a way to customize the coloring of IDA's decompiled code?
IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
- 113
1
vote
2
answers
2k
views
Is it possible/feasible to decompile a program written in C++ to C?
I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know.
If it is possible, ...
- 21
1
vote
1
answer
3k
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
2
votes
1
answer
115
views
Useless instructions in a compiled getter
This is the second time I see this kind of function today :
.text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p
.text:00000000000010B0 lea ...
- 23
2
votes
2
answers
1k
views
MIPS assembly to C code
I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
- 21
0
votes
1
answer
77
views
Reverse engineering mode X VGA function(s)
I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
- 67
0
votes
1
answer
520
views
Converting rep movsd to to C without memcpy
So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the rep movsd is called and logically this is translated as Qmemcpy/memcpy ...
- 793
0
votes
1
answer
157
views
Custom IDA Decompilation Format
Is there a way to customize the format of IDA's decompiled code?
e.g.
char buf[7]; // [rsp+5h] [rbp-1Fh]
to
char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]
or
switch (c)
to
switch( c )
- 113
2
votes
1
answer
1k
views
How do we decompile java so easy?
I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I ...
- 143
1
vote
1
answer
518
views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
- 13
1
vote
2
answers
1k
views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
- 1,858
4
votes
1
answer
12k
views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
- 141
5
votes
1
answer
2k
views
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:
bool __thiscall Player::CanJump(Player *this)
that I ...
- 53
0
votes
1
answer
435
views
What is, and why, "byte[ ] + number" in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
- 1
0
votes
1
answer
744
views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
- 11
1
vote
1
answer
475
views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
- 214
2
votes
1
answer
5k
views
What does this assembly language program output?
I have been struggling with this for a long time. I have the following assembly language code:
.intel_syntax noprefix
.bits 32
.global asm0
asm0:
push ebp
mov ebp,esp
mov eax,DWORD ...
- 165
0
votes
1
answer
499
views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
3
votes
3
answers
4k
views
Android- hiding private keys in .so file
I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
1
vote
5
answers
413
views
C representation of simple assembly
I have the following very simple X86 assembly:
shr cx, 1
jae short <addr>
So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
- 121
1
vote
0
answers
108
views
Decompiled code calls a function with unitialized variables
I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
3
votes
2
answers
3k
views
How do I approach this CTF Debugging Program?
I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats".
The code snippets and my annotations ...
user21677
1
vote
1
answer
177
views
Unknown comparison
I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
- 133
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
0
votes
1
answer
4k
views
IDA pseudo code decompilation
I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding.
Can someone please help me understand what is doing the code below:
char __userpurge sub_41C140@<...
- 11
3
votes
1
answer
699
views
move with sign extension in c code
I'm quite confused with the
movsx(move with sign extension)
I'm trying to convert assembly code to C.
but stuck with movsx part.
this is the code I got so far.
#include <stdio.h>
#...
- 31
2
votes
1
answer
3k
views
Help me reverse this
It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code.
Java signature :
byte[] resultArray = new byte[-2 + dataArray.length];
...
- 23
2
votes
1
answer
17k
views
Hex Rays - strange functions __ROL4__ and __ROR4__
What's purpose of functions ROL and ROR?
For both of them, first arg is int, and second is byte
I suppose that's bitwise shifts
]1s]2
- 143
0
votes
1
answer
1k
views
Arm Assembly: LDRH instruction to C
I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh
The info I've been able to found says that it's ...
- 154
1
vote
1
answer
339
views
Does empty enumeration in C structure creates unnamed field?
I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header):
struct S
{
enum {EN0, EN1};
int m1;
} ;
...
- 475
-2
votes
1
answer
447
views
Help Coverting ASM to C [closed]
I need assistance decompiling the following from ASM to pseudo C.
Code 1
...
mov edx, Var1 # Move Var1 to edx
mov ecx, Var2 # Move Var2 to ecx
mov eax, edx # Move EDX (Var1) to EAX
...
- 201
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 151
0
votes
1
answer
335
views
Mapping a high level statement back in assembly dump
Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the ...
- 1,381
6
votes
1
answer
26k
views
what's the function of LODWORD and HIDWORD?
I'm trying to figure out what does this piece of code exactly:
LODWORD(fMax) = *(_DWORD *)v12;
HIDWORD(fMax) = v13;
I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
0
votes
2
answers
57k
views
EXE to C source code decompiler [duplicate]
Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
- 31
9
votes
1
answer
1k
views
Becoming A Better Reverse Engineer
I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
- 793
4
votes
6
answers
11k
views
How to match disassembled instructions back to C/C++ source?
Basically here's what I want to know, if you have a disassembled instruction say:
jz 0x8048e1a
And, you also have the source code. How do you go about figuring out what this instruction relates to ...
- 191
2
votes
1
answer
1k
views
C What kind of sorting algorithm is this?
I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow
I just don't know which one it ...
- 243
6
votes
2
answers
2k
views
Understanding x86 C main function preamble created by Visual C++
I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program.
To illustrate what I ...
- 828
18
votes
4
answers
181k
views
Converting assembly code to c
I have the following assembly code over Linux distro:
# using the .data section for write permission
# instead of .text section
.section .data
.globl _start
_start:
# displaying some characters ...
- 331
9
votes
1
answer
543
views
How to convert this one-liner asm to C
I want to convert this to C:
SHR CL,1
rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
- 101
11
votes
2
answers
10k
views
Decompile and recompile C?
What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
- 151
9
votes
3
answers
598
views
How to differentiate from different hex files of different families of microcontrollers?
Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or ...
- 277
8
votes
5
answers
1k
views
Is it possible to hide the details of which compiler was used?
The compiler adds system information to the output/object file that is created on compilation.
Is there any compiler option that can prevent this information from being added?
Can the compiler ...
- 2,465