Questions tagged [decompiler]
Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language.
61
questions
0
votes
0answers
47 views
What does the code keyword in Ghidra mean?
I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
3
votes
0answers
109 views
Is there a list of Ghidra's variable prefixes?
In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
-1
votes
1answer
60 views
how to infer data type in ghidra decompilation result
how to infer data type in ghidra decompilation result for /usr/bin/ls ?
1
vote
2answers
112 views
How to decompile /usr/bin/ls
How to decompile the following assembly instructions ?
Note: this could be reproduced using /usr/bin/ls binary inside ghidra
0
votes
1answer
60 views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
0
votes
1answer
83 views
Decompiling tools for “Old” exe files?
I heard about dnSpy or ILSpy for decompiling .net files.
But how about those files that was NOT written by .net!?
Probably those files previous to XP.
Is there any tools to decompile it to, ...
-1
votes
1answer
46 views
Automatic decompilation from Assembly x86
Is there a tool to automatic decompile an assembly x86 code?
What I need is a tool where I simply paste my code and it returns C code.
Thanks
0
votes
0answers
108 views
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
1
vote
1answer
134 views
Need to decompile executable from Openwrt ELF 32-bit
what best tool to use to decompile executable from Openwrt image
ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ?
...
1
vote
0answers
205 views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
1
vote
1answer
157 views
Stack-pointer analysis failed
I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
1
vote
0answers
62 views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
0
votes
1answer
43 views
IDA Pro: __GETDS breaks decompiler output
when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely.
Here's the disassembly:
And ...
1
vote
2answers
112 views
Can I decompile a file if I have a compiler? [closed]
Is it possible to reverse the compiled code using a compiler?
I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.
...
1
vote
1answer
122 views
Is there a way to show exceptions handlers in Hex-Rays decompiler output?
Is there a way to show these exception handlers in the decompiled code?
I can't tell that a block is in a __try block without looking into the disassembly.
__int64 __fastcall ...
0
votes
0answers
37 views
Generate pseudo code not available for some binaries in IDA Pro
I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
2
votes
2answers
322 views
Template code with 0xcccccccc in every ghidra decompiled function for some executables
I often have some code like this on the beginning of every function of a decompiled program:
iVar1 = 0x42;
puVar2 = local_10c;
while (iVar1 != 0) {
iVar1 = iVar1 + -1;
*puVar2 = ...
2
votes
0answers
170 views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
5
votes
1answer
2k views
How do I make a hex literal a decimal literal in Ghidra?
There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
0
votes
1answer
111 views
Is it possible to recover the key to a decrypted file?
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how?
The file I want to recover the key from is a xml that looks like ...
2
votes
1answer
1k views
NSA Ghidra 9 - Is the decompiler open source?
I recently downloaded Ghidra (link) ver 9 on windows.
The decompiler feature is presumable found at
<GHIDRA_HOME>\Ghidra\Features\Decompiler
There is a lib folder containing the Java code. ...
0
votes
1answer
169 views
Is there any decompiler, which can produce a compilable result?
I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
2
votes
2answers
502 views
Is PNF's JEB Reverse Engineering platform written in pure Java?
I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro.
While examining the earlier versions of JEB,...
6
votes
2answers
5k views
Decompile Python for ELF Binaries
There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6.
However, I have a Linux ELF 64-bit binary which was compiled ...
3
votes
2answers
392 views
What's a decompiler that can be extended to new architecture, and how can I do it?
I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
6
votes
4answers
2k views
Can AI be used to write better decompilers/disassemblers? [closed]
In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
6
votes
2answers
805 views
Split variable in Hexrays decompiler?
With Microsoft Visual C++ executables, I often run into decompilations like this:
void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)
{
Pbdf *pbdf; // esi
pbdf = pbdfOrLength;
...
1
vote
1answer
309 views
Tools to translate x86-64 ELF to PPC (or i386 decompilation)
I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC.
Is there a tool that can either:
Translate the binary from x86-64 to PPC (...
1
vote
2answers
2k views
Decompile lua from Unity Games
I discovered that a Unity games have lua scripts. I tried to decompile lua using some tools but they are not working with lua from Unity Games. The header doesn't look the same so they seems encrypted....
1
vote
1answer
2k views
IDA hex-rays decompiler not loaded
I have an executable that is c++(x64) compiled code upon which the decompiler is not loaded. In other files, it works fine. But they are mostly written in c.
I am not sure if it is a limitation in ...
1
vote
1answer
44k views
Can we decompile an .exe or .dll as %100? [closed]
Can we decompile a .exe or .dll file as 100%? Also sometimes seems some
mistakes on somewhere (like mainfrm.cs) , how can we fix that?
What is the best .NET decompiler? or What would you prefer?
I ...
1
vote
1answer
6k views
Why is IDA call analysis failing?
I am trying to reverse an ELF (C++) binary using IDA v6.95. Decompiler complains that the call analysis is failing. I am attaching the IDB database. What can I do to fix the IDB?
0
votes
1answer
210 views
How can i rename Array to API Name in IDAPro?
I am studying to analysis malware..
While to analysis a malware using IDA, I want to rename array to API Name.
To Help your understanding, attached image.
Please help.
Thank you
7
votes
1answer
7k views
What is a good and reliable C decompiler that support ELF and SH4 Architecture?
I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file.
I tried Reko Decompiler which said it does not support SH4 and Snowman ...
-2
votes
1answer
2k views
2
votes
1answer
3k views
Decompiling 64bit ARMv8 Android .so library
I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
0
votes
0answers
443 views
Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?
Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
1
vote
2answers
451 views
How to programatically extract function names, function arguments and strings from a .NET binary?
My goal is to
extract function names,
the libraries they come from (if the functions were imported),
function arguments, and
strings
from a .NET binary. How can I do this?
Is this possible using ...
2
votes
2answers
942 views
Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?
I'm not asking for a decompiler, as I'm aware that it does not produce accurate results all the time. I've tried Googling but all I found were decompilers.
Problem
I found it extremely inefficient ...
1
vote
1answer
252 views
IDA Hex-Rays Generating Redundant Code
Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process.
if ( v1 )
{
v15....
4
votes
6answers
8k views
Are there any interactive decompilers besides HexRays?
Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or ...
4
votes
3answers
12k views
Edit codes in .Net Reflector with Reflexil (Compile Window)
I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes.
I see this picture in reflexil.net:
It Shows the "Compile" window.
How can I see this window and edit codes?
1
vote
1answer
111 views
Recognize certain components in the compiler produced assembly program
Here is my question:
given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program?
It should be very easy if the marked component ...
1
vote
1answer
679 views
Pointer arithmetic in C generated by ida / hexrays decompiler
Please help me understand the following function lines. The loop body does some floating point arithmetic, but why does it cast float pointers to char *, and back?
if ( CG.blockLength >= 4 )
{
...
2
votes
3answers
2k views
IDA decompiler macro
What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below?
double __cdecl sub_401580(float a1)
{
unsigned int v1; // eax@1
double v2; // st7@1
...
-3
votes
1answer
369 views
What are the risks of running a decompiler? [closed]
I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb.
I've searched and ...
5
votes
3answers
1k views
Hash algorithm written in C decompiled with IDA
I have been working on rewriting a program, although it uses a hash to fingerprint the file, I have used IDA to find the function doing the hash and what it is doing to the file before it sends it to ...
2
votes
1answer
5k views
What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]
what does this code on IDA? i've found with this a couple of times and i don't have idea what means.
int a5;
int dGainMax;
COERCE_DOUBLE(__PAIR__(a5, dGainMax))
0
votes
1answer
2k views
Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?
I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this ...
1
vote
0answers
575 views
IDA Pro not showing structures, even when they're defined
I have this kind of code:
I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of:
if(mainStruct->something & 2)
I see:
The offsets 0x364, 0x370, and 0x374 ...
