19
votes
What is a good Java decompiler and deobfuscator?
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
14
votes
Accepted
Are the EU laws preventing reverse engineering of software products?
IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action.
Most reverse engineering restrictions actually come from the ...
- 11.7k
14
votes
Accepted
concat22 in ghidra decompiler
I wanted to comment but it grew up so answering
CONCAT is Concatenation
22 is a suffix that denotes concatenate two bytes with two bytes
it takes two bytes from first location two bytes from ...
- 15.8k
12
votes
How to decompile a C# .exe on macOS?
Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window.
If you need more detailed code change the ...
- 221
10
votes
How to obtain x86-64 pseudocode in IDA Pro?
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
- 11.7k
10
votes
Accepted
How do Enigma, Themida and VMProtect compare to each other?
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors ...
- 216
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,692
9
votes
Are there any interactive decompilers besides HexRays?
Short answer: No, there is no other interactive decompiler, at least not for native codes.
Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
- 4,415
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,344
9
votes
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product.
Please see "Prerequisites" part of Hex-Rays Decompiler Manual:
"The decompiler ...
- 2,438
9
votes
IDA Hex-Rays Decompiler : Show strings instead of offset
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis ...
- 1,632
8
votes
Accepted
Stronger than Themida?
You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated ...
- 5,661
8
votes
Accepted
Can my C# program be dumped from memory and reversed into source code?
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
...
- 1,632
8
votes
Accepted
What does this assembly language program output?
This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6).
push ebp
mov ebp, esp
...
- 4,692
8
votes
Best way to protect source code of .exe program running on Python?
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
...
- 5,980
8
votes
Accepted
How to prevent Ghidra from removing unreachable blocks?
By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
- 98
7
votes
Accepted
What is the meaning of *(_DWORD *)
v7 = *(_DWORD *)(v7 + 8);
Means :
v7 = *(v7 + 8)
Or in assembly
MOV v7, DWORD PTR [v7 + 0x8]
(This is only for understanding purpose, chances are that it's not really like above samples)
v7 is ...
- 465
7
votes
Accepted
How to decompile this assembly code?
Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good ...
- 12.8k
7
votes
Accepted
KeygenMe - My output has one wrong character
Your algorithm calculates the correct byte for each character of the base64 encoded hash, however your implementation of that byte's string encoding is not correct.
Convert.ToChar() simply casts the ...
- 216
7
votes
Accepted
How to decompile an exe file?
I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages?
This question is based on a ...
- 7,018
7
votes
Android- hiding private keys in .so file
If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.
Obfuscation can slow people down, but it won't stop everyone, ...
- 1,982
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 8,839
7
votes
Accepted
XCHG RAX, RAX: 0x09, what does this code do and how does it work?
The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up)
So this ...
- 2,504
7
votes
Accepted
Reverse Engineering bios of ATM Machine
The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code:
cseg:...
- 35.8k
7
votes
How do I import function signatures to Ghidra?
"File" -> "Parse C Source..." ... then parse the ddraw.h
But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly.
A good video about it: https://www....
- 71
7
votes
Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”
fs:0x28 is stack_cookie or stack_canary
_stk_check_fail() is function that aborts execution
the compiler places a cookie in the stack and after returning from a function that manipulates stack it ...
- 15.8k
6
votes
Decompilation techniques for DOS .COM files
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://...
- 1,040
6
votes
Is it possible to convert matlab p-code to something viewable?
It seems like .p files are AES encrypted, with an unknown key, and have been since 2008 from the date of these posts.
However, as matlab itself can read those files, it needs to include the ...
- 12.8k
Only top scored, non community-wiki answers of a minimum length are eligible