Skip to main content
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
16 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
blabb's user avatar
  • 16.4k
14 votes
Accepted

Are the EU laws preventing reverse engineering of software products?

IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action. Most reverse engineering restrictions actually come from the ...
NirIzr's user avatar
  • 11.8k
13 votes

How to decompile a C# .exe on macOS?

Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window. If you need more detailed code change the ...
gandarez's user avatar
  • 231
11 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
3dsboy08's user avatar
  • 226
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
NirIzr's user avatar
  • 11.8k
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
Paweł Łukasik's user avatar
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
Jongware's user avatar
  • 2,364
9 votes

Are there any interactive decompilers besides HexRays?

Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
joxeankoret's user avatar
  • 4,488
9 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler ...
Denis Laskov's user avatar
  • 2,438
9 votes

IDA Hex-Rays Decompiler : Show strings instead of offset

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...
mrexodia's user avatar
  • 1,697
9 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
Frost's user avatar
  • 108
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
mrexodia's user avatar
  • 1,697
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
Paweł Łukasik's user avatar
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,090
8 votes

Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”

fs:0x28 is stack_cookie or stack_canary _stk_check_fail() is function that aborts execution the compiler places a cookie in the stack and after returning from a function that manipulates stack it ...
blabb's user avatar
  • 16.4k
7 votes
Accepted

How to decompile an exe file?

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? This question is based on a ...
julian's user avatar
  • 7,186
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
Antimony's user avatar
  • 2,012
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
Megabeets's user avatar
  • 9,009
7 votes
Accepted

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up) So this ...
Ian Cook's user avatar
  • 2,558
7 votes
Accepted

Reverse Engineering bios of ATM Machine

The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code: cseg:...
Igor Skochinsky's user avatar
  • 36.8k
7 votes

How do I import function signatures to Ghidra?

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www....
John Doe's user avatar
6 votes

Is it possible to convert matlab p-code to something viewable?

It seems like .p files are AES encrypted, with an unknown key, and have been since 2008 from the date of these posts. However, as matlab itself can read those files, it needs to include the ...
Guntram Blohm's user avatar
6 votes
Accepted

Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?

You can try your hand at analyzing programs which are used to introduce reverse engineering concepts in academia such the binaries available for download at RPI's "Modern Binary Exploitation" course ...
julian's user avatar
  • 7,186
6 votes
Accepted

What are the steps to reverse engineering a Shockwave .DCR file?

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...
dsasmblr's user avatar
  • 2,234
6 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
ErbaZZ's user avatar
  • 76
6 votes

i need software to decode this subtitle xml file, anyone know what it encodes with?

It's AES encrypted, but fortunately it's pretty trivial to see what's going on in the JavaScript file responsible for decoding (https://www.gohitv.com/series/js/hiplayer.min.js) by using browser ...
user7290573's user avatar
5 votes
Accepted

Mapping Android resource IDs to resource string

Using apktool you can decompile a program's resources. Also you can use JEB to view the resource id. In res/values, you can find the id using name in public.xml (or something similar, e.g. publics....
Misty's user avatar
  • 428
5 votes
Accepted

Hex Rays - strange functions __ROL4__ and __ROR4__

Check out IDA directory\plugins\defs.h. ... // Macros to represent some assembly instructions // Feel free to modify them #define __ROL__(x, y) __rotl__(x, y) // Rotate left #define __ROR__(x, ...
mikfig's user avatar
  • 66

Only top scored, non community-wiki answers of a minimum length are eligible