All Questions
Tagged with decompile or decompilation
602 questions
2
votes
0
answers
685
views
Decompiling an APK of Unity framework with IL2CPP
Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed?
I tried stuff like https://github.com/Perfare/...
- 21
4
votes
1
answer
3k
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 309
3
votes
1
answer
84
views
Double constructor when reversing Unity game
When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set.
Here is an example:
...
- 328
3
votes
1
answer
149
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 31
2
votes
1
answer
4k
views
Decompile and Re-compile iOS app (.ipa file)
As a part of college project, I have to showcase how I can get ios app from jailbroken devices and reverse-engineer it. In the first part of slide, I am showing how we can get the IPA file from ...
- 211
2
votes
0
answers
132
views
I trying rewrite asm to c++ [closed]
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?
push rbp
push r15
push r14
push r13
push r12
push ...
- 21
1
vote
0
answers
113
views
decompile, build apk without mdify code have error like app crashed and icon changed
I want to try modifying the apk and when I try to build then install there is no problem, but when I check the icon on the apk changes like the default Android icon and the app crashes. Likewise when ...
- 11
1
vote
0
answers
77
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
3
votes
1
answer
200
views
What tricks can I use to manually decompile a set of instructions
ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are
eax
ebx
ecx
edx
esi
length of user input (min length is 3)
0
...
- 141
4
votes
1
answer
344
views
IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text
Recently I got a program that has two colors of .text segment, one is black and the other is brown:
While the flow chart and the decompiler work well on black part, they are both disabled on the ...
- 163
2
votes
0
answers
220
views
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
- 21
2
votes
0
answers
50
views
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
- 21
2
votes
0
answers
73
views
Cant view some classes while inspecting APK's code
I'm trying to understand how the application works.
I used dex2jar utility to receive .jar file (d2j-dex2jar --force file.apk). And jd-gui to view it's classes.
I'm able to view the most of them. But ...
2
votes
0
answers
41
views
Find out what is this binary database entry and what format it is
the following varbinary "BUFFER" of a database entry is for an article.
FIELD_0 is in plain text and the item name is "1", which I created with the item management software.
[...
- 21
2
votes
0
answers
123
views
Which encryption method has been used?
Anyone please can you tell me which method used to encrypt this kind of codes?
im really confused, that would really helps me.
This encrypted data created by a PHP.
Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
- 21
2
votes
1
answer
113
views
How to interpret this __ctype_b based predicate?
I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
4
votes
0
answers
558
views
How to list all references to memory from selected memory region in ghidra?
I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
- 141
1
vote
0
answers
152
views
Extracting contents of unknown file format
I would love some help on working with this file format.
I have this archived file from this abandonware game that I like to mess around with, and I have tried all sorts to try and expand it to ...
- 19
1
vote
1
answer
476
views
Are there websites for reverse engineering challenges similar the programming challenges? [duplicate]
As a developer, reverse engineering has always fascinated me. It amazes me to see what some people can figure out just from a dump of assembly code, and I would like to become better at doing the same....
1
vote
2
answers
1k
views
Decompiling and Recompiling APK leads to crash using Apktool
Decompiling and recompiling an apk causes it to crash. My goal is simply to insert a method into smali code that prints a stacktrace, but even decompiling and recompiling with no changes causes the ...
- 121
2
votes
0
answers
311
views
Dumping .NET Dynamic Methods
I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
- 21
0
votes
2
answers
296
views
How to Convert given set of Assembly-Level Instructions to High-Level Language Code?
As I am working on malware analysis, I got stuck in a place where I have to change the given set of assembly-level instructions to high-level code. Example:
Assembly Level Code
mov ebp, esp
...
- 39
1
vote
0
answers
112
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
3
votes
1
answer
494
views
Reverse-engineering a 90s CNC machine (FORTH like) firmware
Here's an undertaking I'm currently in, and would absolutely love someone to assist more directly. I'll list the subjects that I would greatly appreciate more knowledge within. Know anything about one ...
9
votes
1
answer
4k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 91
2
votes
1
answer
2k
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
1
vote
1
answer
1k
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 87
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
1
vote
1
answer
434
views
Decrypting .toc file
So I have a few files from a game on my pc, most of which are .toc files
I believe this means they are a "table of contents" as the ending suggests, but my attempts to read them have been ...
- 11
2
votes
0
answers
259
views
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
- 309
2
votes
0
answers
245
views
How to correct decompiled output with `in_stack_` (ppc BE)?
So I have something like:
*************************************************************
* SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con ..
...
- 475
2
votes
1
answer
190
views
Decompilation output modification in IDA Pro
I am trying to modify cfunc AST from
If (a1 && some_func_ptr) {
some_func_ptr();
}
To
if (a1) {
some_func_ptr();
}
But I constantly get INTERR 50683 error. I tried
new_item = idaapi....
- 81
1
vote
0
answers
70
views
Mod Coder Pack for minecraft 1.8.8 failed to decompile
I tried to decompile minecraft 1.8.8 using MCP918 and I have an error that I cannot fix.
Here are the logs:
https://zerobin.net/?07c9671c16bc4011#g6co8FZc8RJkkQiPb6pu65HixcEORkWZGN8qHPXkHew=
Some ...
- 11
0
votes
1
answer
157
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
1
vote
0
answers
1k
views
Ida Pro can't decompile big function
I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error :
The graph is too big (more than 1000 nodes) to be displayed on the screen.
Switching to text mode.
(you ...
- 183
0
votes
1
answer
586
views
Missing mnemonics '??' in Ghidra Assembly Code
I was just trying to google and search for "??" Ghidra with no luck.
I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
- 101
1
vote
1
answer
221
views
Python or C for a Qt application and security against reverse engineering
I actually have two choices : C or Python to create my application.
On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
- 113
3
votes
0
answers
317
views
Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?
I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
- 153
3
votes
1
answer
1k
views
STM32 - Disable Voltage Check
I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to
disable the Voltage check (allow alternative power source)...
- 131
1
vote
1
answer
88
views
How to utilize `FillOutStructureCmd`?
Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables.
It looks something like this:
public class ...
- 475
2
votes
0
answers
398
views
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
- 29
4
votes
0
answers
1k
views
Understand a function within Hermes byte code
The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.
I was able to disassemble the binary file ...
1
vote
0
answers
791
views
Decompile C#, xaml and wpf application
I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
- 11
2
votes
0
answers
89
views
LG C1 Firmware Flashing/Modifying
I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
0
votes
1
answer
613
views
Decompile obfuscated jar file
Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail.
Please can someone help, I'm happy to tip for your help :)
https://...
1
vote
0
answers
781
views
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
- 11
1
vote
0
answers
104
views
What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?
I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
- 11
2
votes
0
answers
5k
views
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:
This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as ...
- 35
0
votes
1
answer
2k
views
Deobfuscator and decompiler for .NET [closed]
Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
- 11
0
votes
1
answer
597
views
How to reference an address set by 2 instructions in Ghidra
I encountered the following 2 instructions while reversing Tricore assembly:
These 2 instructions load the final address: 0x804A9474. Where a global symbol resides.
Is there a way to hint Ghidra the ...
- 43