All Questions
Tagged with decompilation x86
24 questions
1
vote
0
answers
84
views
Freeware x86 decompilers for Windows with debug? [closed]
I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables.
That above was a quick ...
- 111
0
votes
1
answer
157
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
1
vote
2
answers
369
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 69
0
votes
2
answers
180
views
Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?
I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.
The first time someone asked me about this project I told them I was 'reverse ...
- 133
1
vote
1
answer
356
views
What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?
Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc.
I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
- 475
2
votes
0
answers
3k
views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
- 121
2
votes
0
answers
326
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
0
votes
1
answer
744
views
How can I convert the following assembly code to pseudo code?
I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.
push ebp
mov ebp, esp
sub esp, 14h
mov dword ptr [ebp-14h], 1
mov dword ptr [ebp-10h], 2
mov ...
- 11
1
vote
0
answers
936
views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
- 215
3
votes
1
answer
1k
views
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
Given the following short assembly snippet:
shr rax, 3
adc rax, 0
I worked this out a bit:
We know SHR sets the CF with the last bit shifted.
We know ADC dest, 0 is just adding the CF.
So ...
- 1,789
1
vote
1
answer
1k
views
What is the password to this file? I can't figure it out with radare2 or gdb
Here is the binary file. https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing
I am able to figure out some of the assembly, but can't get the correct password. I know ...
- 135
1
vote
5
answers
413
views
C representation of simple assembly
I have the following very simple X86 assembly:
shr cx, 1
jae short <addr>
So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
- 121
1
vote
1
answer
177
views
Unknown comparison
I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
- 133
-2
votes
1
answer
638
views
How decompilation works? [closed]
what is the theory behind the subject of translate assembly code to pseudo code?
Could you explain few words ? Also some book about it?
- 11
0
votes
2
answers
820
views
Static Linking as an anti-RE method?
A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports. But doesn't static linking a ...
2
votes
2
answers
819
views
What does this combination SCAS and STOS?
I have a simple snippet with several instructions:
01: mov edi, [ebp+8]
02: mov edx, edi
03: xor eax, eax
04: or ecx, 0FFFFFFFFh
05: repne scasb
06: add ecx, 2
07: neg ...
- 155
0
votes
2
answers
2k
views
While Loop Correct?
I am reversing some x86 from an old CTF from 2014 and am trying to understand the below code (it has been shortened drastically). I believe it is performing some sort of while or for loop through a ...
- 1
3
votes
1
answer
178
views
Connecting a Motion Simulator to GTA
I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time. Since all the GTA games are super hackable (with respect to physics, map, & texture hacking), AND the ...
- 33
0
votes
1
answer
274
views
COM file starting point
I'm having issue reversing a small old COM file from the early 90s. My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before). However some of the ...
3
votes
1
answer
1k
views
IDA PRO and Dos Load Exec
I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace?
It has already ...
- 31
6
votes
2
answers
2k
views
Understanding x86 C main function preamble created by Visual C++
I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program.
To illustrate what I ...
- 828
11
votes
3
answers
113k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 119
13
votes
3
answers
9k
views
Reverse engineer an old DOS QBasic executable
I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.
I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
- 131
33
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 9,218