47
votes
Decompiling iPhone App
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...
- 5,561
19
votes
What is a good Java decompiler and deobfuscator?
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
15
votes
Accepted
What's the difference between a disassembler, debugger and decompiler?
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called ...
- 20.4k
14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
14
votes
Accepted
Becoming A Better Reverse Engineer
These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest:
Examine the assembly output of various ...
- 2,416
14
votes
Accepted
Are the EU laws preventing reverse engineering of software products?
IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action.
Most reverse engineering restrictions actually come from the ...
- 11.4k
13
votes
Accepted
Recovering .NET sources into full blown project
JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
- 390
12
votes
Accepted
concat22 in ghidra decompiler
I wanted to comment but it grew up so answering
CONCAT is Concatenation
22 is a suffix that denotes concatenate two bytes with two bytes
it takes two bytes from first location two bytes from ...
- 14.9k
10
votes
What are the possibilities for reverse engineering an IPA file to its source?
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 ...
10
votes
How to obtain x86-64 pseudocode in IDA Pro?
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64,...
- 11.4k
10
votes
Accepted
How to tell if a particular .NET assembly was written in C# or F#?
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...
- 4,522
9
votes
How to extract functions from one executable to include/link in another
Assume you have some unknown object file. The source code of it was
#include <stdio.h>
#include <string.h>
#define NCHAR 26
void setkey(int i);
char *encrypt(char *s);
char keybuf[...
- 12.7k
9
votes
Are there any interactive decompilers besides HexRays?
Short answer: No, there is no other interactive decompiler, at least not for native codes.
Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
- 4,315
9
votes
Accepted
What are the steps, to extract an unknown archive file in this case?
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
...
- 2,274
9
votes
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product.
Please see "Prerequisites" part of Hex-Rays Decompiler Manual:
"The decompiler ...
- 2,438
9
votes
How to decompile a C# .exe on macOS?
Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window.
If you need more detailed code change the ...
- 191
9
votes
Accepted
How do Enigma, Themida and VMProtect compare to each other?
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors ...
- 206
9
votes
IDA Hex-Rays Decompiler : Show strings instead of offset
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis ...
- 1,602
8
votes
Accepted
C What kind of sorting algorithm is this?
It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function ...
- 96
8
votes
Accepted
Stronger than Themida?
You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated ...
- 5,561
8
votes
Accepted
Can my C# program be dumped from memory and reversed into source code?
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
...
- 1,602
8
votes
Accepted
What does this assembly language program output?
This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6).
push ebp
mov ebp, esp
...
- 4,522
8
votes
Accepted
Reverse Engineering bios of ATM Machine
The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code:
cseg:...
- 34.7k
8
votes
Best way to protect source code of .exe program running on Python?
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
...
- 5,850
7
votes
Accepted
Coalesce Enums in IDA?
Yes, it is possible. The enum must be set to the 'bitfield' kind, and the bit masks must be set appropriately. Position the cursor on the enum name (in the Enums view) and hit Ctrl-N; in the lower ...
- 1,960
7
votes
Accepted
How to decompile this assembly code?
Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good ...
- 12.7k
7
votes
Accepted
KeygenMe - My output has one wrong character
Your algorithm calculates the correct byte for each character of the base64 encoded hash, however your implementation of that byte's string encoding is not correct.
Convert.ToChar() simply casts the ...
- 216
7
votes
Accepted
How to decompile an exe file?
I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages?
This question is based on a ...
- 6,859
7
votes
Android- hiding private keys in .so file
If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.
Obfuscation can slow people down, but it won't stop everyone, ...
- 1,972
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 8,639
Only top scored, non community-wiki answers of a minimum length are eligible