Questions tagged [decompile]

Process of translating an unstructured assembler program into a structured high-level language program (e.g. translation from x86 to C).

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
4answers
95 views

Are there any 64 bit MIPS decompilers

I’ve found many mips 32 bit decompilers. I’m trying to decompile a simple 64bit elf from mips to c. Ida doesn’t seem to have much of a problem with disassembly. After some fixings I tried the ...
0
votes
2answers
400 views

Hex-Rays skips code

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings. Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
1
vote
0answers
41 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
1
vote
1answer
65 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
0
votes
0answers
97 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
0
votes
0answers
25 views

Decompiling PYC file gives “Embedded file name”

I have a PYC file (https://pastebin.com/raw/dcWfYZSV) and when I decompile using uncompyle6 I get https://pastebin.com/JqL7ZB0W It says "Embedded file name" - stupid question but is that the ...
1
vote
0answers
696 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
0
votes
0answers
47 views

Change PHP Function behaviour on a encrypted file

I have a PHP file that is encrypted with Ioncube. Searching on the internet I found one guy which has decoded it, but when I run the decoded file, the code behavior changes so I can't replace the ...
0
votes
0answers
33 views

ILSpy loads .NET with multiple assemblies. DotnetPeek/DNSpy/Telerik and .NET Reflector don't?

using ILSpy, I can load a .NET executable file that contains 5 .NETCoreApp modules. None of the other programs in the subject are able to do this. They don't recognize the EXE as .NET. My first ...
0
votes
0answers
75 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
0
votes
1answer
748 views

How can I modify or decompile Hermes JS bytecode?

Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode. The Hermes documentation mentions hbcdump ...
1
vote
0answers
95 views

Right way to reverse a VM

I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
1
vote
1answer
359 views

How can I get classes from “protected” JAR file?

I'm trying to get classes from JAR file / actually running JVM machine but: When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too. When ...
-2
votes
1answer
136 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
0
votes
0answers
407 views

Reverse exe file compiled by pyinstaller

I am trying to get python source code from only exe file compiled by pyinstaller. I used the pyinstxtractor.py and got extracted folder. And then what or how should I do? Or could you explain other ...
0
votes
1answer
38 views

what means “ilegal use of registers”?

I read pe program using a Pe Reader to view all sections, the .text section starts is "0x0001000": What is in the pe program reader: And is this what i see on the debugguer :
3
votes
1answer
4k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
3
votes
1answer
563 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
-1
votes
1answer
135 views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
1
vote
2answers
174 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
2
votes
1answer
1k views

Decompiling .pyc file to 0 byte .py file

i am doing the CTF-like challenges. One of these tasks need us to decompiling Python bytecode 3.8 (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte The original file'...
2
votes
1answer
196 views

Invalid file path error while trying to rebuild with apktool and aapt2

I am facing an error while try to repack an apk with apkool. below is the error trace. W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'. W: error: invalid file ...
-1
votes
1answer
64 views

Automatic decompilation from Assembly x86

Is there a tool to automatic decompile an assembly x86 code? What I need is a tool where I simply paste my code and it returns C code. Thanks
0
votes
0answers
369 views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
-1
votes
1answer
88 views

How to decode a .plr file

I have a .plr file that contains all of the player information for the game Terarria. I would like to decode it to have a look at what data is stored on this file so that I can play around with making ...
1
vote
1answer
180 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
0
votes
1answer
128 views

“check:” keyword in Ghidra

I have disassembled the crackme0x06 challenge (http://security.cs.rpi.edu/courses/binexp-spring2015 inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra ...
1
vote
1answer
1k views

Decompiling Python Files: ValueError

So I have this python file and I successfully unpacked its content inside of it we have our file.pyc I appended the magic bytes to it so it went from: E3 00 00 00 00 00 00 00 00 00 00 00 00 to ...
-2
votes
1answer
3k views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
1
vote
1answer
326 views

Need to decompile executable from Openwrt ELF 32-bit

what best tool to use to decompile executable from Openwrt image ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ? ...
-1
votes
1answer
59 views

How to find where a subroutine is being called (ida)

I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
1
vote
2answers
407 views

Methods for preventing IDA decompiler

I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
0
votes
0answers
107 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
1
vote
0answers
58 views

(Help) APK Decomplied unreadable .pngs

I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
0
votes
1answer
206 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
5
votes
1answer
859 views

Erlang Source file generation from .beam file

I have Erlang application's beam files which I want to decompile. Application is Compiled and build with 'debug_info' options. here is snippet of emake file to which is used to build application : {...
1
vote
2answers
725 views

Dlink DIR 600M firmware decompile issues

How to decompile the CGI & ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing. NOTE: Its not the same as DIR 600 ...
7
votes
0answers
411 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
2
votes
0answers
236 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
0
votes
1answer
692 views

Android Reverse Engineering Network Traffic Stack Trace

Lets say an Android application sends out a traffic out to the server and expects a Json Response Request: https://server:port/userid=user1&token=randomstring7345 We want to replicate the ...
2
votes
1answer
966 views

How to override c++ string class with LD_PRELOAD

i am trying to override predefined functions such as strcmp, getenv, etc. i already override some of them using LD_PRELOAD options. but i can't override string class, how can i override c++ string ...
4
votes
5answers
49k views

Recover source code for C# .exe

I paid a freelancer programmer for an app to tun my clinic. He got about 95% of the project done, but then got a job elsewhere and vanished into thin air, along with my source code... So, I have a ...
1
vote
1answer
1k views

Decompile a DLL file from Microsoft Media Creation Tool

In this Superuser topic Windows 10 Media Creation Tool, how does it work?, it is possible to extract the URL from SetupMgr.dll. My question is, how do I extract this URL from SetupMgr.dll? I want to ...
0
votes
1answer
212 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
0
votes
1answer
738 views

Reverse engineer the update-binary file in Android recovery update packages

I am trying to understand how to disassemble or at least get a readable copy of the update-binary file located in /META-INF/com/google/android/. It is a modified version for a smartwatch, which ...
4
votes
3answers
16k views

Decompile ARM native binary - IDA Pro detects file as Shared Object

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as ELF for ARM (Shared object) Binary file If I choose ELF for ARM (Shared object), ...
3
votes
0answers
239 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
1
vote
1answer
53k views

Can we decompile an .exe or .dll as %100? [closed]

Can we decompile a .exe or .dll file as 100%? Also sometimes seems some mistakes on somewhere (like mainfrm.cs) , how can we fix that? What is the best .NET decompiler? or What would you prefer? I ...
0
votes
1answer
971 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...