Hot answers tagged


I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


As part of ASLR, operating systems use code relocation tables embedded in an executable to change the location where an executable image is located. If you remove the relocation tables (or generate an executable without it to begin with) the operating system will not be able to relocate the executable image, however other images also loaded to the same ...


You can check "graceful failures" for some common problems that can prevent decompilation and try to induce them deliberately. However, most of them can be worked around with a bit of effort so don’t expect them to stop a motivated person.

Only top voted, non community-wiki answers of a minimum length are eligible