64

If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see this page). otool -arch armv7 -l thebinary | grep crypt (where thebinary is the ...


61

Unpacking a generic wrapping packer or cryptor usually involves the following steps: 1. Trace the code, possibly evading or bypassing anti-debugging checks. This is not difficult with simple packers but might be tricky with the more advanced ones. They may employ timing checks (rdtsc), exception-based control transfer, using debug registers for ...


49

ILSpy is a great open-source decompiler. ILSpy Features Assembly browsing IL Disassembly Support C# 5.0 "async" Decompilation to C# Supports lambdas and 'yield return' Shows XML documentation Decompilation to VB Saving of resources Save decompiled assembly as .csproj Search for types/methods/properties (substring) Hyperlink-...


42

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


40

TL;DR: machine code decompilers are very useful, but do not expect the same miracles that they provide for managed languages. To name several limitations: the result generally can't be recompiled, lacks names, types, and other crucial information from the original source code, is likely to be much more difficult to read than the original source code minus ...


36

I'll answer this in two parts, #1 is relatively easy, #2 impossible to the level which I'm assuming you want. 1. Extracting the hex code from the Uno: While the specifics will depend on the revision of the Uno that you have, you'll want to use avrdude (available for linux, bundled with the OS X Arduino software) and a command similar to the following that ...


35

It's not only possible but has been done already, and not just once. Here's three I know about, and there may be more. Kivlad by Cody Brocious http://www.matasano.com/research/kivlad/ DAD by Zost (Androguard project): http://code.google.com/p/androguard/wiki/Decompiler JEB by Nicolas Falliere (commercial) http://www.android-decompiler.com/ Then there ...


33

My apologies for the belated reply. I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.


30

Sogeti's Origami framework comes with a GTK based GUI. What is it? origami is a Ruby framework designed to parse, analyze, and forge PDF documents. This is NOT a PDF rendering library. It aims at providing a scripting tool to generate and analyze malicious PDF files. As well, it can be used to create on-the-fly customized PDFs, or to inject (...


23

I've used JetBrains dotPeek (free of charge) before with some success. Any JetBrains software I've ever used has been very solid. It is not quite the 'original source' but it is very readable C# - about the closest thing I would expect to get. Quote from their website: What's Cool about dotPeek? Decompiling .NET 1.0-4.5 assemblies to C# ...


22

I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder): For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip ...


22

After decrypting an IPA file on a jailbroken iDevice, you can use a much more affordable alternative to IDA Pro called Hopper - the mult-platform disassembler for < $100. http://www.hopperapp.com/ It has support for analyzing iOS executables (among others) and even comes with the ability to convert ARM assembly to pseudo-C.


21

What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this: https://github.com/Mysterie/uncompyle2 It runs on Python 2.7 but supports decompiling 2.5 to 2.7. Note that some commercial projects has been known to use modified Python interpreters. Modifications can ...


17

As 0xea said, the .so file are just regular executable files but packed in a dynamic library style. I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools. Extract the functions from the library A first step will be to extract the name of all ...


16

It's extremely easy to decompile. LLVM for a long time shipped with a CBackend that would convert LLVM into C. The LLVM that is created by todays frontends (clang) is very amenable to any kind of analysis and understanding that you can think of. So you can probably just use normal LLVM tools (opt, llc) to "decompile" the IR. I find LLVM IR quite readable ...


16

Alex Ionescu, co-author of the latest "Windows Internals" book and contributor to ReactOS, wrote a good paper on the topic of VB decompilation quite a while ago. Here the direct link to the PDF (originally from http://www.alex-ionescu.com/vb.pdf). The paper documents the structures and constants of the file format itself and probably goes a long way in ...


15

(I was planning to make it a comment but it turned out rather long and it makes an answer on its own) Some of the comments mentioned the Hex-Rays decompiler. Its basic ideas are not a trade secret and are in fact described in the white paper by Ilfak Guilfanov which accompanies the presentation he gave in 2008. I'll paste the relevant part here: Local ...


14

In fact, the answer is a bit subtle. According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program. On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...


14

Here is the list of few decompilation tools / resources that you may find useful. IDA Pro + Hex-Rays decompiler Hopper disassembler (has a decompiler) ODA (Online Disassembler) Retargetable Decompiler


13

Igor's answer is very good. However, the outlined techniques rely on the assumption that at some point the executable is unpacked in memory. This is not always true. Virtualization obfusactors compile the original binary into a custom instruction set when is executed by an simulator at runtime. If you encounter a binary obfuscated in this way you have no ...


13

You might find pyREtic from Immunity to be useful. The presentation from BlackHat USA 2010 on pyREtic is here (YouTube). pyREtic Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to take a object in memory back to source code, without needing access to the bytecode directly on disk. This can be useful if the applictions pyc's ...


13

rECX = (rECX & 0xFFFFFF00) | ((rECX & 0xFF) >> 1)


13

IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action. Most reverse engineering restrictions actually come from the EULA/Terms of service and other contractual binding agreements between the software provider and the user. Often times Clean room methodologies are used to ...


12

Decompilation is just one method of reverse engineering. From the decompilation description: Decompiling is the process of analyzing an executable or object code binary and outputting source code in a programming language such as C. The process involves translating a file from a low level of abstraction to a higher level of abstraction. ...


12

They are some tools can be useful in reversing p-code binary vb-decompiler lite (free ver): very good decompiler can be download from vb-decompiler official site P32Dasm: another p-code decompiler see here and see below of page how they debug p-code with IDA WKTVBDE: p-code debugger, I don't work with it but good to try, to download search tuts4you.com ...


12

I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this : Once you found it, remove all the content ...


12

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...


11

There is a free tool available called JustDecompile which does that. Some features: Creating a Visual Studio project from an assembly in order to export lost projects or obtain multiple classes without the need to copy and paste code. At present, JustDecompile is able to export decompiled code only to C#. Exporting code directly from the command ...


11

There is SmartDec, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of IDA Flirt signatures and will make use of runtime information if you use it together with funcap. There is also Retargetable Decompiler, an ...


10

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


Only top voted, non community-wiki answers of a minimum length are eligible