47 votes

Decompiling iPhone App

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...
user avatar
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
15 votes
Accepted

What's the difference between a disassembler, debugger and decompiler?

These terms are currently defined on this site as follows: Disassembler: A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called ...
user avatar
14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
user avatar
  • 159
14 votes
Accepted

Becoming A Better Reverse Engineer

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various ...
user avatar
  • 2,381
14 votes
Accepted

Are the EU laws preventing reverse engineering of software products?

IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action. Most reverse engineering restrictions actually come from the ...
user avatar
  • 11.3k
13 votes
Accepted

Recovering .NET sources into full blown project

JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
user avatar
  • 390
12 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
user avatar
  • 14.8k
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
user avatar
9 votes

What are the possibilities for reverse engineering an IPA file to its source?

I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux. Check out this tutorial to dive in by building your own debugger in 5 ...
user avatar
9 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
user avatar
  • 11.3k
9 votes

How to extract functions from one executable to include/link in another

Assume you have some unknown object file. The source code of it was #include <stdio.h> #include <string.h> #define NCHAR 26 void setkey(int i); char *encrypt(char *s); char keybuf[...
user avatar
9 votes

Are there any interactive decompilers besides HexRays?

Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
user avatar
  • 4,305
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
user avatar
  • 2,274
9 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler ...
user avatar
  • 2,438
9 votes

How to decompile a C# .exe on macOS?

Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window. If you need more detailed code change the ...
user avatar
  • 191
9 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
user avatar
  • 206
9 votes

IDA Hex-Rays Decompiler : Show strings instead of offset

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...
user avatar
  • 1,602
8 votes
Accepted

C What kind of sorting algorithm is this?

It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function ...
user avatar
  • 96
8 votes
Accepted

Stronger than Themida?

You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated ...
user avatar
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
user avatar
  • 1,602
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
user avatar
8 votes
Accepted

Reverse Engineering bios of ATM Machine

The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code: cseg:...
user avatar
  • 34.6k
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
user avatar
  • 5,850
7 votes
Accepted

Coalesce Enums in IDA?

Yes, it is possible. The enum must be set to the 'bitfield' kind, and the bit masks must be set appropriately. Position the cursor on the enum name (in the Enums view) and hit Ctrl-N; in the lower ...
user avatar
  • 1,940
7 votes
Accepted

How to decompile this assembly code?

Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good ...
user avatar
7 votes
Accepted

KeygenMe - My output has one wrong character

Your algorithm calculates the correct byte for each character of the base64 encoded hash, however your implementation of that byte's string encoding is not correct. Convert.ToChar() simply casts the ...
user avatar
7 votes
Accepted

How to decompile an exe file?

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? This question is based on a ...
user avatar
  • 6,819
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
user avatar
  • 1,972
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
user avatar
  • 8,579

Only top scored, non community-wiki answers of a minimum length are eligible