Questions tagged [decompilation]

Process of translating assembly code extracted from a binary file in a structured programming language, such as C.

132 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
0 answers
707 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
Lorenzo Ivan's user avatar
6 votes
0 answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
crush's user avatar
  • 233
5 votes
1 answer
179 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
Cesar Canassa's user avatar
5 votes
0 answers
3k views

Can IDA generate C code for ASM assembly without the binary?

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
Mo Beigi's user avatar
  • 151
5 votes
1 answer
2k views

Understanding AutoIT "compilation"

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
majidarif's user avatar
  • 235
4 votes
1 answer
3k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
4 votes
0 answers
940 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
A Dark Divided Gem's user avatar
4 votes
0 answers
449 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
trunklop's user avatar
  • 149
4 votes
0 answers
10k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
Jimmy Hankey's user avatar
3 votes
0 answers
923 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 309
3 votes
0 answers
289 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
lethal-guitar's user avatar
3 votes
0 answers
1k views

Ghidra not decompiling very simple ARM64 program

I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64) My Assembly code looks like this: .global _start _start: ...
JohnnyBoy's user avatar
3 votes
0 answers
3k views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
Purya's user avatar
  • 31
3 votes
0 answers
785 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
sborpo's user avatar
  • 131
3 votes
0 answers
315 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
WhiteAngel's user avatar
3 votes
1 answer
2k views

Fixing ghidra decompilation

i am working a little bit with Ghidra. My assembly code doesn't match with the decompiled code: * FUNCTION * ...
AndiYo's user avatar
  • 49
2 votes
0 answers
59 views

How to find where an instance variable of some object is set to some concrete value?

I have a binary which implements license restrictions for concurrent users to a hard-coded value of 4. For various reasons I need to increase that hard-coded value, but am unable to build the app on ...
Thorsten Schöning's user avatar
2 votes
0 answers
94 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
2 votes
0 answers
205 views

Why i cant see source code from this dll

// PE file does not contain any managed metadata.
Zeko It's user avatar
  • 21
2 votes
0 answers
581 views

Decompiling an APK of Unity framework with IL2CPP

Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed? I tried stuff like https://github.com/Perfare/...
forvev's user avatar
  • 21
2 votes
0 answers
207 views

How to Decompile HP LaserJet Pro M12w firmware in Ghidra

I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra, after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
A.Motahari's user avatar
2 votes
0 answers
41 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
2 votes
0 answers
65 views

Cant view some classes while inspecting APK's code

I'm trying to understand how the application works. I used dex2jar utility to receive .jar file (d2j-dex2jar --force file.apk). And jd-gui to view it's classes. I'm able to view the most of them. But ...
2 votes
0 answers
39 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
Chrischi's user avatar
2 votes
0 answers
122 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. IbĀŖā€žļ£æbƏ}ā—ŠKƬ-yNĆ®Ėœ>Eļ¬Ā¶Ć˜ĆĆ‡_^Ā§ ...
Mr Xero's user avatar
  • 21
2 votes
0 answers
466 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
omicronns's user avatar
  • 121
2 votes
0 answers
298 views

Dumping .NET Dynamic Methods

I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the ...
Net_Newb's user avatar
2 votes
1 answer
2k views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6. I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
Cave Johnson123's user avatar
2 votes
0 answers
244 views

How this data can be referenced in Ghidra?

I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view: UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,...
hanan's user avatar
  • 309
2 votes
0 answers
214 views

How to correct decompiled output with `in_stack_` (ppc BE)?

So I have something like: ************************************************************* * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con .. ...
rec's user avatar
  • 475
2 votes
0 answers
349 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
Miguel's user avatar
  • 29
2 votes
0 answers
86 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
GrandmaNeedsHelp's user avatar
2 votes
0 answers
5k views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file - which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
MendelG's user avatar
  • 53
2 votes
0 answers
111 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
Ronny's user avatar
  • 73
2 votes
0 answers
230 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
lemniscate's user avatar
2 votes
0 answers
525 views

Right way to reverse a VM

I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
rustam Shirinov's user avatar
2 votes
0 answers
127 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
Dar's user avatar
  • 21
2 votes
0 answers
239 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
cpast's user avatar
  • 121
2 votes
0 answers
2k views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
zelcon's user avatar
  • 121
2 votes
0 answers
2k views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
hyk's user avatar
  • 21
2 votes
0 answers
316 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
Martin Brooker's user avatar
2 votes
0 answers
1k views

Reconstruct InnoSetup file with existing CompiledCode.bin

Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option. Basically ...
Duxa's user avatar
  • 121
2 votes
0 answers
354 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
StevenHughes's user avatar
2 votes
0 answers
961 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
Biswapriyo's user avatar
  • 1,559
2 votes
0 answers
170 views

Hopper: What does stack[xxxx] mean?

When using the 'decompiler' tool in Hopper on the start function of an application it shows this: What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to ...
pzirkind's user avatar
  • 437
2 votes
0 answers
365 views

VST audio samples

Ques: How difficult would it be to extract audio samples from a VST extension/plugin? The author has made their software available for free but it was designed as an extension for a much larger music ...
d33j's user avatar
  • 121
2 votes
0 answers
502 views

Jar reversing: Can't open as zip file nor open it with common decompilers

I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client. So after running JD-...
Igarr's user avatar
  • 21
2 votes
0 answers
3k views

Unpacking Inno Setup installers with InnoExtractor?

I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn? I get this application from here.
user8067's user avatar
2 votes
0 answers
236 views

What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?

In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java ...
Annamalai N's user avatar
1 vote
0 answers
216 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar