65

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page). otool -arch armv7 -l thebinary | grep crypt (where thebinary is the ...


46

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


34

My apologies for the belated reply. I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.


30

Sogeti's Origami framework comes with a GTK based GUI. What is it? origami is a Ruby framework designed to parse, analyze, and forge PDF documents. This is NOT a PDF rendering library. It aims at providing a scripting tool to generate and analyze malicious PDF files. As well, it can be used to create on-the-fly customized PDFs, or to inject (evil) code into ...


24

What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this: https://github.com/Mysterie/uncompyle2 It runs on Python 2.7 but supports decompiling 2.5 to 2.7. Note that some commercial projects has been known to use modified Python interpreters. Modifications can ...


22

After decrypting an IPA file on a jailbroken iDevice, you can use a much more affordable alternative to IDA Pro called Hopper - the mult-platform disassembler for < $100. http://www.hopperapp.com/ It has support for analyzing iOS executables (among others) and even comes with the ability to convert ARM assembly to pseudo-C.


20

Here is the list of few decompilation tools / resources that you may find useful. IDA Pro + Hex-Rays decompiler Hopper disassembler (has a decompiler) ODA (Online Disassembler) Retargetable Decompiler Boomerang (decompiler)


18

As 0xea said, the .so file are just regular executable files but packed in a dynamic library style. I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools. Extract the functions from the library A first step will be to extract the name of all ...


16

It's extremely easy to decompile. LLVM for a long time shipped with a CBackend that would convert LLVM into C. The LLVM that is created by todays frontends (clang) is very amenable to any kind of analysis and understanding that you can think of. So you can probably just use normal LLVM tools (opt, llc) to "decompile" the IR. I find LLVM IR quite readable ...


16

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it. Java DeObfuscator Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...


16

Alex Ionescu, co-author of the latest "Windows Internals" book and contributor to ReactOS, wrote a good paper on the topic of VB decompilation quite a while ago. Here the direct link to the PDF (originally from http://www.alex-ionescu.com/vb.pdf). The paper documents the structures and constants of the file format itself and probably goes a long way in ...


15

These terms are currently defined on this site as follows: Disassembler: A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language. Debugger: Debuggers allow the user to view and change the running state of a program. Decompiler: Software used to revert the process of ...


14

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


14

In fact, the answer is a bit subtle. According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program. On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...


14

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...


13

You might find pyREtic from Immunity to be useful. The presentation from BlackHat USA 2010 on pyREtic is here (YouTube). pyREtic Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to take a object in memory back to source code, without needing access to the bytecode directly on disk. This can be useful if the applictions pyc's ...


13

rECX = (rECX & 0xFFFFFF00) | ((rECX & 0xFF) >> 1)


13

JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:


13

IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action. Most reverse engineering restrictions actually come from the EULA/Terms of service and other contractual binding agreements between the software provider and the user. Often times Clean room methodologies are used to ...


12

They are some tools can be useful in reversing p-code binary vb-decompiler lite (free ver): very good decompiler can be download from vb-decompiler official site P32Dasm: another p-code decompiler see here and see below of page how they debug p-code with IDA WKTVBDE: p-code debugger, I don't work with it but good to try, to download search tuts4you.com ...


12

I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this : Once you found it, remove all the content ...


11

Other users have done a good job with the elements of this question that are specific to the IPA format. As for obtaining the source code to a binary object, please see this answer as for why this may be more difficult than you expect (as compared to, say, bytecode language decompilation).


11

Decompilation is just one method of reverse engineering. From the decompilation description: Decompiling is the process of analyzing an executable or object code binary and outputting source code in a programming language such as C. The process involves translating a file from a low level of abstraction to a higher level of abstraction. Decompilation is ...


11

I am not aware of a currently active generic "firmware reversing" forum. A few years ago there was a pretty ambitious attempt with lostscrews.com but unfortunately it languished due to lack of attention, got overwhelmed with spam and eventually the domain has expired. I think the guys behind the /dev/ttyS0 blog also tried opening a forum a couple months ago ...


11

Java compiles to bytecode that is run in the JVM, and stored in the .class files. This bytecode is not a 1:1 representation of the original code, and includes several compiler-implemented optimizations. Information is lost when these optimizations are performed, and due to that lost information decompilers can't reconstruct the code back into exactly what it ...


11

Delphi implements try/except/finally by using Win32 Structured Exception Handlers (SEH). The basics of SEH are explained in the classic article by Matt Pietrek, so I'll skip to the details relevant to Delphi only. 1. try entry Entry to a try block, or a block which protects automatic variables that need to be destructed on exit (such as strings) looks like ...


11

There is SmartDec, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of IDA Flirt signatures and will make use of runtime information if you use it together with funcap. There is also Retargetable Decompiler, an ...


10

If you have a jailbroken iDevice, AppSec Labs' iNalyzer can automate some of this process for you as well as provide you with a great way to review an iOS application.adding the appropriate repo You can install iNalyzer from Cydia after adding the appropriate repo. In my experience, it's easiest to work with the iNalyzer created project files (that you ...


10

The classic work on the decompilation is Cristina Cifuentes' PhD thesis "Reverse Compilation Techniques". She describes generation of C code in Chapter 7. The author of the REC decompiler also has a nice summary about the decompilation process, though it's more informal: http://www.backerstreet.com/decompiler/introduction.htm For completeness, here's ...


10

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for previewing but for example dnSpy, ILSpy allow you to pick your favourite one. Just wondering if there's any tools that allows F#. Not sure/haven't seen one. Despite ...


Only top voted, non community-wiki answers of a minimum length are eligible