46
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...
34
My apologies for the belated reply.
I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.
21
Here is the list of few decompilation tools / resources that you may find useful.
IDA Pro + Hex-Rays decompiler
Hopper disassembler (has a decompiler)
ODA (Online Disassembler)
Retargetable Decompiler
Boomerang (decompiler)
18
As 0xea said, the .so file are just regular executable files but packed in a dynamic library style.
I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools.
Extract the functions from the library
A first step will be to extract the name of all ...
16
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
15
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called assembly language.
Debugger:
Debuggers allow the user to view and change the running state of a program.
Decompiler:
Software used to revert the process of ...
14
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ILSpy :
Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil)
https://github.com/0xd4d/dnlib
dnlib was created because de4dot needed a robust .NET ...
14
In fact, the answer is a bit subtle.
According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program.
On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...
14
These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest:
Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...
13
rECX = (rECX & 0xFFFFFF00) | ((rECX & 0xFF) >> 1)
13
JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
13
IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action.
Most reverse engineering restrictions actually come from the EULA/Terms of service and other contractual binding agreements between the software provider and the user.
Often times Clean room methodologies are used to ...
12
I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this :
Once you found it, remove all the content ...
11
Java compiles to bytecode that is run in the JVM, and stored in the .class files. This bytecode is not a 1:1 representation of the original code, and includes several compiler-implemented optimizations. Information is lost when these optimizations are performed, and due to that lost information decompilers can't reconstruct the code back into exactly what it ...
11
Delphi implements try/except/finally by using Win32 Structured Exception Handlers (SEH). The basics of SEH are explained in the classic article by Matt Pietrek, so I'll skip to the details relevant to Delphi only.
1. try entry
Entry to a try block, or a block which protects automatic variables that need to be destructed on exit (such as strings) looks like ...
11
There is SmartDec, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of IDA Flirt signatures and will make use of runtime information if you use it together with funcap. There is also Retargetable Decompiler, an ...
10
The classic work on the decompilation is Cristina Cifuentes' PhD thesis "Reverse Compilation Techniques". She describes generation of C code in Chapter 7.
The author of the REC decompiler also has a nice summary about the decompilation process, though it's more informal:
http://www.backerstreet.com/decompiler/introduction.htm
For completeness, here's ...
10
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for previewing but for example dnSpy, ILSpy allow you to pick your favourite one. Just wondering if there's any tools that allows F#. Not sure/haven't seen one.
Despite ...
9
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis ...
9
Assume you have some unknown object file. The source code of it was
#include <stdio.h>
#include <string.h>
#define NCHAR 26
void setkey(int i);
char *encrypt(char *s);
char keybuf[NCHAR];
char codepoint(char c);
int main(void) {
char *secret;
setkey(5);
secret=strdup("Hello World");
printf("%s\n", encrypt(secret));
}
void ...
9
Short answer: No, there is no other interactive decompiler, at least not for native codes.
Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other decompilers for native code that I know (I'm not talking about Java or .NET) were created as batch tools. The closest to a half interactive decompiler is Snowman, but ...
9
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
For the moment, skip the header "BigFile" and the immedtaly following data and concentrate on these filenames alone.
If the filenames have different lengths, ...
9
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features.
I will also not be ...
9
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis options and uncheck Print only constant string literals:
I learned about this option from the great Life In Hex blog, but I cannot find the post right now...
9
I wanted to comment but it grew up so answering
CONCAT is Concatenation
22 is a suffix that denotes concatenate two bytes with two bytes
it takes two bytes from first location two bytes from second location and produces a 4 byte result
here it is probably making a wide character string
you can see the difference of two bytes in the address too ...
8
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 minutes using Frida and Qml. The last part shows how to inject code into the “Yo” app and plot its network connections on Google Maps.
8
As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64.
However, if you need something that will work on x86_64 take a look at ida-decompiler:
An IDA plugin that attempts to decompile a function. Written in Python. To try it in IDA, place your cursor on a function, and execute ...
8
It seems that different answers correspond to different interpretations of the question. A C++ compiler creates a binary from source code. A C++ decompiler would create source code from the binary.
It's not possible, generally, to recreate the source (comments, macro definitions and local variable names, for example often don't exist in any form in the ...
8
It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function and something else in the second half of the function.
The only tricky part is that once it finds an occurrence of the string to find, it iterates to find the ...
8
You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated hardware dongle intended for copy protection. Make sure the dongle is one that actually runs your algorithms and doesn't just encrypt some parts of the code and run ...
Only top voted, non community-wiki answers of a minimum length are eligible
