Skip to main content

Questions tagged [decompiler]

Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language.

Filter by
Sorted by
Tagged with
1 vote
1 answer
97 views

Kawai ES110 - Firmware supplied as MIDI file, what can we do?

The firmware for this digital piano is supplied as a MIDI file with an EasyPlayer.exe (not sure if Wine can run this properly) binary to upload it. I'm wondering if there's a way to get at it's ...
4 votes
1 answer
1k views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
0 votes
0 answers
60 views

Make a reverse engineering for dead app

Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
0 votes
1 answer
130 views

Ghidra decompiler does not recognize rsp being subtracted

while i'm reversing a PE binary, i got some weird decompiler output. return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame ...
0 votes
1 answer
366 views

i need software to decode this subtitle xml file, anyone know what it encodes with?

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt? Subtitle link xml
1 vote
0 answers
281 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
1 vote
1 answer
1k views

how to infer data type in ghidra decompilation result

how to infer data type in ghidra decompilation result for /usr/bin/ls ?
2 votes
0 answers
108 views

IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?

I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is: flag = 0; for ( i = 0; i < 10; i++ ) { if ( flag ) ...
2 votes
1 answer
423 views

IDA decompiler: show a "for" loop instead of a "while", is it possible?

I'm reversing an embedded code, and faced with this "while" loop in while decompiling: It's more readable for me if a "for" loop be shown instead a "while", i.e.: while ...
2 votes
2 answers
280 views

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
3 votes
0 answers
568 views

Is there an MFC Decompiler available?

I want to know if there is already an MFC Decompiler? So far, you have to decompile by hand - which is very tedious. I would like a tool like DeDe Decompiler. The C++ code itself is not important. It ...
1 vote
0 answers
147 views

Change the behavior of any running process

Would it be possible to develop a program that decompiles the instructions of a running process, for example into a C-like language, and allows them to be modified and then injected into the process ...
5 votes
1 answer
4k views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
3 votes
0 answers
101 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
1 vote
1 answer
348 views

Assign a constant value to an ARM register

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this: ...
2 votes
2 answers
14k views

Why is IDA call analysis failing?

I am trying to reverse an ELF (C++) binary using IDA v6.95. Decompiler complains that the call analysis is failing. I am attaching the IDB database. What can I do to fix the IDB?
5 votes
2 answers
21k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
3 votes
0 answers
712 views

How to deal with this Ghidra decompile error?

I'm getting the following Ghidra decompile error on one function: Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space I don't see anything unusual about the ...
2 votes
1 answer
148 views

Can obfuscation be applied on certain parts?

I am newbie to this field. I am still learning from your wonderful contributions, help and guidance. I have had an app that i want to study in-depth. How the the it is constructed? What components ...
5 votes
1 answer
11k views

Decompile a NodeJS compiled program maybe by NEXE

I recently got idiotly scammed one of my discord account but kept the malware in case. Curious, I would love today to break into the executable to fetch any information about the scammer. I decompiled ...
3 votes
0 answers
104 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
2 votes
1 answer
756 views

Patch .net executable via hex editor

What I am trying to do: I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue: // Program.DoWork public static int SomeValue => 15; In code, ...
1 vote
1 answer
471 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I ...
16 votes
6 answers
15k views

Decompilation techniques for DOS .COM files

I've found a binary copy of a DOS freeware game I was fond of back in the day (Firefighter, downloadable as FIRE.COM) but the source code is not available. I'd like to re-implement it in C or Python ...
3 votes
1 answer
1k views

What does Ghidra mean by ._0_3_?

What does ._0_3_ mean in the Ghidra decompiler? my_string[0]._0_3_ = CONCAT12(DAT_14123b1f6,DAT_14123b1f4);
1 vote
2 answers
543 views

How to stop Hex Rays optimizations?

I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
0 votes
0 answers
88 views

Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?

I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even ...
10 votes
1 answer
5k views

Is there a list of Ghidra's variable prefixes?

In Ghidra, the decompiler prepends various prefixes to variable names. For instance, iVar1 is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm ...
12 votes
4 answers
6k views

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
9 votes
2 answers
15k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
1 vote
1 answer
205 views

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

I'm writing a compiler from .NET CIL code to some high level language. Process is similar to decompilation. I have done some control flow analysis - detecting loops, ifs, and so on. In terms of data ...
0 votes
0 answers
879 views

Can I ignore this Ghidra USTACK var?

I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
2 votes
1 answer
421 views

Hex-Ray Decompiler: inline function not recognized

While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
1 vote
1 answer
5k views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
2 votes
2 answers
2k views

NSA Ghidra 9 - Is the decompiler open source?

I recently downloaded Ghidra (link) ver 9 on windows. The decompiler feature is presumable found at <GHIDRA_HOME>\Ghidra\Features\Decompiler There is a lib folder containing the Java code. ...
0 votes
1 answer
4k views

Recaf: Recompile disabled, can't edit

I've download recaf jar file and install JDK 8. When I execute it/start it, it all works fine with java -jar recaf-2.12.0-J8-jar-with-dependencies.jar. I open a class file also no problem. The issue ...
3 votes
1 answer
7k views

Decompiling 64bit ARMv8 Android .so library

I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?
1 vote
2 answers
462 views

How to decompile /usr/bin/ls

How to decompile the following assembly instructions ? Note: this could be reproduced using /usr/bin/ls binary inside ghidra
8 votes
1 answer
8k views

How do I make a hex literal a decimal literal in Ghidra?

There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
0 votes
1 answer
628 views

Decompiling tools for "Old" exe files?

I heard about dnSpy or ILSpy for decompiling .net files. But how about those files that was NOT written by .net!? Probably those files previous to XP. Is there any tools to decompile it to, ...
-1 votes
1 answer
178 views

Automatic decompilation from Assembly x86

Is there a tool to automatic decompile an assembly x86 code? What I need is a tool where I simply paste my code and it returns C code. Thanks
0 votes
0 answers
1k views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
1 vote
1 answer
1k views

Need to decompile executable from Openwrt ELF 32-bit

what best tool to use to decompile executable from Openwrt image ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ? ...
4 votes
0 answers
856 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
2 votes
1 answer
1k views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
0 votes
1 answer
101 views

IDA Pro: __GETDS breaks decompiler output

when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely. Here's the disassembly: And ...
2 votes
2 answers
2k views

Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?

I'm not asking for a decompiler, as I'm aware that it does not produce accurate results all the time. I've tried Googling but all I found were decompilers. Problem I found it extremely inefficient ...
1 vote
2 answers
487 views

Can I decompile a file if I have a compiler? [closed]

Is it possible to reverse the compiled code using a compiler? I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file. ...
2 votes
1 answer
1k views

Is there a way to show exceptions handlers in Hex-Rays decompiler output?

Is there a way to show these exception handlers in the decompiled code? I can't tell that a block is in a __try block without looking into the disassembly. __int64 __fastcall ...
2 votes
2 answers
564 views

Template code with 0xcccccccc in every ghidra decompiled function for some executables

I often have some code like this on the beginning of every function of a decompiled program: iVar1 = 0x42; puVar2 = local_10c; while (iVar1 != 0) { iVar1 = iVar1 + -1; *puVar2 = ...