Skip to main content

Questions tagged [decompiler]

Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language.

17 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
1 answer
1k views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
genghiskhan's user avatar
4 votes
0 answers
856 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar
3 votes
0 answers
568 views

Is there an MFC Decompiler available?

I want to know if there is already an MFC Decompiler? So far, you have to decompile by hand - which is very tedious. I would like a tool like DeDe Decompiler. The C++ code itself is not important. It ...
user avatar
3 votes
0 answers
101 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,870
3 votes
0 answers
712 views

How to deal with this Ghidra decompile error?

I'm getting the following Ghidra decompile error on one function: Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space I don't see anything unusual about the ...
Phil Strenski's user avatar
3 votes
0 answers
104 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
0xC0000022L's user avatar
  • 10.9k
2 votes
0 answers
108 views

IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?

I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is: flag = 0; for ( i = 0; i < 10; i++ ) { if ( flag ) ...
E.A's user avatar
  • 171
2 votes
0 answers
323 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
Martin Brooker's user avatar
1 vote
0 answers
281 views

Ghidra: undefined4 to bytearray

I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line. The c++ code contains the following line: BYTE fileArray[139] = {0x50, 0x51....} Ghidra ...
0x0000000000000000000's user avatar
1 vote
0 answers
147 views

Change the behavior of any running process

Would it be possible to develop a program that decompiles the instructions of a running process, for example into a C-like language, and allows them to be modified and then injected into the process ...
Axeryon's user avatar
  • 11
1 vote
0 answers
1k views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
rev's user avatar
  • 1,293
0 votes
0 answers
60 views

Make a reverse engineering for dead app

Hi,there is an app (Voip Recorder & Screen Recorder)the developer stopped updating the app from 3 years, and it's the only app in the world could record the screen with internal sound likes ...
AWS NEBRAS's user avatar
0 votes
1 answer
130 views

Ghidra decompiler does not recognize rsp being subtracted

while i'm reversing a PE binary, i got some weird decompiler output. return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame ...
msh's user avatar
  • 1
0 votes
0 answers
88 views

Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?

I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even ...
test_dev dev_test's user avatar
0 votes
0 answers
879 views

Can I ignore this Ghidra USTACK var?

I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
Perolan's user avatar
0 votes
0 answers
1k views

Ghidra wrong array size

I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of ...
Paa's user avatar
  • 71
0 votes
0 answers
549 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
sherlock's user avatar
  • 1,381