47
iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...
21
Here is the list of few decompilation tools / resources that you may find useful.
IDA Pro + Hex-Rays decompiler
Hopper disassembler (has a decompiler)
ODA (Online Disassembler)
Retargetable Decompiler
Boomerang (decompiler)
17
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.
Java DeObfuscator
Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...
15
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called assembly language.
Debugger:
Debuggers allow the user to view and change the running state of a program.
Decompiler:
Software used to revert the process of ...
14
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ILSpy :
Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil)
https://github.com/0xd4d/dnlib
dnlib was created because de4dot needed a robust .NET ...
14
In fact, the answer is a bit subtle.
According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program.
On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...
14
These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest:
Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...
14
IANAL; If this is done by a company, you need to consult a lawyer that specializes in the field of computer law before taking any action.
Most reverse engineering restrictions actually come from the EULA/Terms of service and other contractual binding agreements between the software provider and the user.
Often times Clean room methodologies are used to ...
13
rECX = (rECX & 0xFFFFFF00) | ((rECX & 0xFF) >> 1)
13
JetBrains dotPeek is a free decompiler that has the option of decompiling whole assemblies into VS projects:
12
I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this :
Once you found it, remove all the content ...
12
I wanted to comment but it grew up so answering
CONCAT is Concatenation
22 is a suffix that denotes concatenate two bytes with two bytes
it takes two bytes from first location two bytes from second location and produces a 4 byte result
here it is probably making a wide character string
you can see the difference of two bytes in the address too ...
11
There is SmartDec, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of IDA Flirt signatures and will make use of runtime information if you use it together with funcap. There is also Retargetable Decompiler, an ...
10
Why does decompiling an F# assembly produce C# code?
It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for previewing but for example dnSpy, ILSpy allow you to pick your favourite one. Just wondering if there's any tools that allows F#. Not sure/haven't seen one.
Despite ...
9
I would recommend checking out Frida. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.
Check out this tutorial to dive in by building your own debugger in 5 minutes using Frida and Qml. The last part shows how to inject code into the “Yo” app and plot its network connections on Google Maps.
9
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis ...
9
Assume you have some unknown object file. The source code of it was
#include <stdio.h>
#include <string.h>
#define NCHAR 26
void setkey(int i);
char *encrypt(char *s);
char keybuf[NCHAR];
char codepoint(char c);
int main(void) {
char *secret;
setkey(5);
secret=strdup("Hello World");
printf("%s\n", encrypt(secret));
}
void ...
9
Short answer: No, there is no other interactive decompiler, at least not for native codes.
Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other decompilers for native code that I know (I'm not talking about Java or .NET) were created as batch tools. The closest to a half interactive decompiler is Snowman, but ...
9
I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.
For the moment, skip the header "BigFile" and the immedtaly following data and concentrate on these filenames alone.
If the filenames have different lengths, ...
9
Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product.
Please see "Prerequisites" part of Hex-Rays Decompiler Manual:
"The decompiler requires the latest version of IDA..."
https://www.hex-rays.com/products/decompiler/manual/prereq.shtml
But this question, IMO, should be addressed to the Hex-...
9
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features.
I will also not be ...
9
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis options and uncheck Print only constant string literals:
I learned about this option from the great Life In Hex blog, but I cannot find the post right now...
8
It seems that different answers correspond to different interpretations of the question. A C++ compiler creates a binary from source code. A C++ decompiler would create source code from the binary.
It's not possible, generally, to recreate the source (comments, macro definitions and local variable names, for example often don't exist in any form in the ...
8
It's a binary search. I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function and something else in the second half of the function.
The only tricky part is that once it finds an occurrence of the string to find, it iterates to find the ...
8
You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated hardware dongle intended for copy protection. Make sure the dongle is one that actually runs your algorithms and doesn't just encrypt some parts of the code and run ...
8
It is in fact trivial to dump the byte array or the module directly from dnSpy.
To mimic the described scenario I wrote some trivial example code:
using System.IO;
using System.Reflection;
namespace DumpAssembly
{
class Program
{
static void Main(string[] args)
{
var rawAssembly = File.ReadAllBytes("Test.dll");
...
8
Visual Studio for Mac can do the job. Just hit File / Open and then choose the executable or library you want. It'll open the Assembly Browser window.
If you need more detailed code change the Visibility to All members and the Language to C#.
8
This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6).
push ebp
mov ebp, esp
Those two lines are what's is called the function prologue. We first save the calling function stack frame (ebp is tracking that) and in the second one, we set our ...
8
The files in the update are not ARM but classic 16-bit x86 code. For example, loading bios.bin at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code:
cseg:FFF0 _reset:
cseg:FFF0
cseg:FFF0 FA ...
8
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...
Only top voted, non community-wiki answers of a minimum length are eligible