19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
Kalibr's user avatar
  • 159
14 votes
Accepted

Are the EU laws preventing reverse engineering of software products?

IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action. Most reverse engineering restrictions actually come from the ...
NirIzr's user avatar
  • 11.7k
14 votes
Accepted

concat22 in ghidra decompiler

I wanted to comment but it grew up so answering CONCAT is Concatenation 22 is a suffix that denotes concatenate two bytes with two bytes it takes two bytes from first location two bytes from ...
blabb's user avatar
  • 15.8k
12 votes

How to decompile a C# .exe on macOS?

Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window. If you need more detailed code change the ...
gandarez's user avatar
  • 221
10 votes

How to obtain x86-64 pseudocode in IDA Pro?

The two other answers here are outdated. From hex-rays website, in the page about the the hex-rays decompiler: Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
NirIzr's user avatar
  • 11.7k
10 votes
Accepted

How do Enigma, Themida and VMProtect compare to each other?

Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research. This comparison will only include the protectors ...
3dsboy08's user avatar
  • 216
10 votes
Accepted

How to tell if a particular .NET assembly was written in C# or F#?

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
Paweł Łukasik's user avatar
9 votes

Are there any interactive decompilers besides HexRays?

Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
joxeankoret's user avatar
  • 4,415
9 votes
Accepted

What are the steps, to extract an unknown archive file in this case?

I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack. ...
Jongware's user avatar
  • 2,344
9 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler ...
Denis Laskov's user avatar
  • 2,438
9 votes

IDA Hex-Rays Decompiler : Show strings instead of offset

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...
mrexodia's user avatar
  • 1,632
8 votes
Accepted

Stronger than Themida?

You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated ...
Peter Andersson's user avatar
8 votes
Accepted

Can my C# program be dumped from memory and reversed into source code?

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...
mrexodia's user avatar
  • 1,632
8 votes
Accepted

What does this assembly language program output?

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...
Paweł Łukasik's user avatar
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 5,980
8 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
Frost's user avatar
  • 98
7 votes
Accepted

What is the meaning of *(_DWORD *)

v7 = *(_DWORD *)(v7 + 8); Means : v7 = *(v7 + 8) Or in assembly MOV v7, DWORD PTR [v7 + 0x8] (This is only for understanding purpose, chances are that it's not really like above samples) v7 is ...
Hackndo's user avatar
  • 465
7 votes
Accepted

How to decompile this assembly code?

Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good ...
Guntram Blohm's user avatar
7 votes
Accepted

KeygenMe - My output has one wrong character

Your algorithm calculates the correct byte for each character of the base64 encoded hash, however your implementation of that byte's string encoding is not correct. Convert.ToChar() simply casts the ...
Mike Haboustak's user avatar
7 votes
Accepted

How to decompile an exe file?

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? This question is based on a ...
julian's user avatar
  • 7,018
7 votes

Android- hiding private keys in .so file

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, ...
Antimony's user avatar
  • 1,982
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
Megabeets's user avatar
  • 8,839
7 votes
Accepted

XCHG RAX, RAX: 0x09, what does this code do and how does it work?

The shr rax, 3 is an unsigned divide by 8 with truncation towards zero. The inclusion of the adc rax, 0 makes the division round to nearest instead. (Though 0.5 will always be rounded up) So this ...
Ian Cook's user avatar
  • 2,504
7 votes
Accepted

Reverse Engineering bios of ATM Machine

The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code: cseg:...
Igor Skochinsky's user avatar
  • 35.8k
7 votes

How do I import function signatures to Ghidra?

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www....
John Doe's user avatar
7 votes

Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”

fs:0x28 is stack_cookie or stack_canary _stk_check_fail() is function that aborts execution the compiler places a cookie in the stack and after returning from a function that manipulates stack it ...
blabb's user avatar
  • 15.8k
6 votes

Decompilation techniques for DOS .COM files

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool: https://...
John Källén's user avatar
6 votes

Is it possible to convert matlab p-code to something viewable?

It seems like .p files are AES encrypted, with an unknown key, and have been since 2008 from the date of these posts. However, as matlab itself can read those files, it needs to include the ...
Guntram Blohm's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible