Questions tagged [decompiler]
Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language.
77
questions
1
vote
0
answers
93
views
How to deal with this Ghidra decompile error?
I'm getting the following Ghidra decompile error on one function:
Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space
I don't see anything unusual about the ...
0
votes
0
answers
81
views
Ghidra "WARNING: Could not recover jumptable"
I get the title warning often when Ghidra is examining code that is pretty clearly coming from C switch block, and as a result many blocks of code are missing from decompile. The assembly pattern is ...
2
votes
0
answers
48
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.5k
0
votes
0
answers
112
views
Why does Ghidra save a function return value to a different variable?
I've started learning how to work with Ghidra and I've stumbled upon a problem that I don't know how to solve.
The program that I am disassembling calls a function argc_check, which returns a result ...
1
vote
1
answer
109
views
Patch .net executable via hex editor
What I am trying to do:
I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue:
// Program.DoWork
public static int SomeValue => 15;
In code, ...
- 121
5
votes
1
answer
4k
views
Decompile a NodeJS compiled program maybe by NEXE
I recently got idiotly scammed one of my discord account but kept the malware in case.
Curious, I would love today to break into the executable to fetch any information about the scammer.
I decompiled ...
- 51
2
votes
1
answer
254
views
What does Ghidra mean by ._0_3_?
What does ._0_3_ mean in the Ghidra decompiler?
my_string[0]._0_3_ = CONCAT12(DAT_14123b1f6,DAT_14123b1f4);
- 145
0
votes
2
answers
165
views
IDA PRO decompiler expression last question (pseudocode)
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);
.....
shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;
.....
shellcode(&hkernel32, 0)
If ...
0
votes
0
answers
32
views
Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?
I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even ...
1
vote
1
answer
99
views
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
- 13
0
votes
0
answers
245
views
Can I ignore this Ghidra USTACK var?
I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
12
votes
4
answers
5k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
1
vote
2
answers
186
views
How to stop Hex Rays optimizations?
I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
- 1,750
2
votes
1
answer
125
views
Can obfuscation be applied on certain parts?
I am newbie to this field. I am still learning from your wonderful contributions, help and guidance.
I have had an app that i want to study in-depth. How the the it is constructed? What components ...
- 21
0
votes
1
answer
1k
views
Recaf: Recompile disabled, can't edit
I've download recaf jar file and install JDK 8. When I execute it/start it, it all works fine with java -jar recaf-2.12.0-J8-jar-with-dependencies.jar. I open a class file also no problem. The issue ...
0
votes
0
answers
109
views
Change the behavior of any running process
Would it be possible to develop a program that decompiles the instructions of a running process, for example into a C-like language, and allows them to be modified and then injected into the process ...
- 1
1
vote
1
answer
1k
views
How to open new window of decompiler or resize the decompiler of Ghidra?
This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize.
Any help?
EDIT: Oh thanks Shane Riley, i clicked the blue button ...
3
votes
0
answers
2k
views
What does the code keyword in Ghidra mean?
I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
- 43
9
votes
1
answer
2k
views
Is there a list of Ghidra's variable prefixes?
In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
- 191
-1
votes
1
answer
404
views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
- 126
1
vote
2
answers
295
views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
- 126
1
vote
1
answer
650
views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
- 320
0
votes
1
answer
306
views
Decompiling tools for "Old" exe files?
I heard about dnSpy or ILSpy for decompiling .net files.
But how about those files that was NOT written by .net!?
Probably those files previous to XP.
Is there any tools to decompile it to, ...
- 111
-1
votes
1
answer
96
views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
- 31
0
votes
0
answers
770
views
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
- 13
1
vote
1
answer
664
views
Need to decompile executable from Openwrt ELF 32-bit
what best tool to use to decompile executable from Openwrt image
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ?
...
- 11
3
votes
0
answers
593
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
2
votes
1
answer
531
views
Stack-pointer analysis failed
I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
- 1,370
1
vote
1
answer
218
views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
- 57
0
votes
1
answer
71
views
IDA Pro: __GETDS breaks decompiler output
when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely.
Here's the disassembly:
And ...
- 57
1
vote
2
answers
304
views
Can I decompile a file if I have a compiler? [closed]
Is it possible to reverse the compiled code using a compiler?
I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.
...
- 111
2
votes
1
answer
532
views
Is there a way to show exceptions handlers in Hex-Rays decompiler output?
Is there a way to show these exception handlers in the decompiled code?
I can't tell that a block is in a __try block without looking into the disassembly.
__int64 __fastcall ...
- 23
2
votes
2
answers
456
views
Template code with 0xcccccccc in every ghidra decompiled function for some executables
I often have some code like this on the beginning of every function of a decompiled program:
iVar1 = 0x42;
puVar2 = local_10c;
while (iVar1 != 0) {
iVar1 = iVar1 + -1;
*puVar2 = ...
- 169
2
votes
0
answers
237
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
8
votes
1
answer
6k
views
How do I make a hex literal a decimal literal in Ghidra?
There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
- 183
0
votes
1
answer
119
views
Is it possible to recover the key to a decrypted file?
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how?
The file I want to recover the key from is a xml that looks like ...
2
votes
2
answers
1k
views
NSA Ghidra 9 - Is the decompiler open source?
I recently downloaded Ghidra (link) ver 9 on windows.
The decompiler feature is presumable found at
<GHIDRA_HOME>\Ghidra\Features\Decompiler
There is a lib folder containing the Java code. ...
- 257
0
votes
1
answer
348
views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
- 204
2
votes
2
answers
648
views
Is PNF's JEB Reverse Engineering platform written in pure Java?
I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro.
While examining the earlier versions of JEB,...
- 257
7
votes
2
answers
11k
views
Decompile Python for ELF Binaries
There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6.
However, I have a Linux ELF 64-bit binary which was compiled ...
- 685
4
votes
2
answers
662
views
What's a decompiler that can be extended to new architecture, and how can I do it?
I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
- 665
7
votes
4
answers
4k
views
Can AI be used to write better decompilers/disassemblers? [closed]
In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
- 189
7
votes
2
answers
1k
views
Split variable in Hexrays decompiler?
With Microsoft Visual C++ executables, I often run into decompilations like this:
void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)
{
Pbdf *pbdf; // esi
pbdf = pbdfOrLength;
...
- 993
1
vote
1
answer
575
views
Tools to translate x86-64 ELF to PPC (or i386 decompilation)
I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC.
Is there a tool that can either:
Translate the binary from x86-64 to PPC (...
- 123
1
vote
2
answers
2k
views
Decompile lua from Unity Games
I discovered that a Unity games have lua scripts. I tried to decompile lua using some tools but they are not working with lua from Unity Games. The header doesn't look the same so they seems encrypted....
- 133
1
vote
1
answer
3k
views
IDA hex-rays decompiler not loaded
I have an executable that is c++(x64) compiled code upon which the decompiler is not loaded. In other files, it works fine. But they are mostly written in c.
I am not sure if it is a limitation in ...
- 228
1
vote
1
answer
59k
views
Can we decompile an .exe or .dll as %100? [closed]
Can we decompile a .exe or .dll file as 100%? Also sometimes seems some
mistakes on somewhere (like mainfrm.cs) , how can we fix that?
What is the best .NET decompiler? or What would you prefer?
I ...
- 111
2
votes
2
answers
9k
views
Why is IDA call analysis failing?
I am trying to reverse an ELF (C++) binary using IDA v6.95. Decompiler complains that the call analysis is failing. I am attaching the IDB database. What can I do to fix the IDB?
- 1,251
0
votes
1
answer
279
views
How can i rename Array to API Name in IDAPro?
I am studying to analysis malware..
While to analysis a malware using IDA, I want to rename array to API Name.
To Help your understanding, attached image.
Please help.
Thank you
9
votes
2
answers
12k
views
What is a good and reliable C decompiler that support ELF and SH4 Architecture?
I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file.
I tried Reko Decompiler which said it does not support SH4 and Snowman ...
- 229