4

In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that Java code keeps by design, including, but not limited to the following list: Class names Method names Properties names and types Methods borders Exact ...


4

For IDA/Hex-Rays: In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003). In the Structures window (View->Open subviews->Structures), import KUSER_SHARED_DATA. You can simply write the name of the type in the dialog box and ...


4

This is more of an extended comment than an empirically researched answer. Perspective 1: Decompiler Design Assumption Violation Abstractly, one way that we can think about this is in terms of tool design. A tool tends to perform best when applied to problems its designer developed the tool to solve. Keeping in mind that decompilers perform the reverse of ...


3

If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm talking about following lines: int v7; // [sp+10h] [bp-42Ch]@1 char v8; // [sp+14h] [bp-428h]@1 int v9; ...


3

I don't understand why they would be actually wrong compilers convert high level code in human readable form (like C) to low level code (so that machine could understand it). During compilation most of the semantic as well as syntactic information gets lost due to language transformation, multiple optimizations, etc. Debug symbols may preserve some ...


3

For most languages -- especially ones that are compiled directly into machine code -- the answer to whether knowing the compiler makes it easier to decompile them is "no". I wrote a post a while ago explaining the difficulties that machine code decompilers face; none of them are made easier by knowing the compiler. However, your question doesn't ...


3

The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays). In IDA 7.4 and above (I think; might have been 7.3), right-click the variable and press "Jump to xref globally", as follows: You'll get a popup with all global x-...


3

Please see Batch Operation In the decompiler’s manual.


2

That depends entirely on your approach, if you do it all manually there are fewer instructions to remember, if there is a decompiler that does/tries it automatically it's obviously easier to implement with less instructions but once you want to go beyond purely translating the asm to c code that somehow works and want to make it readable a complex ...


2

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the most popular combo for reading files is probably CreateFile and ReadFile api calls. If you track every operation performed on the buffer filled using ReadFile ...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


2

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble it.


2

In general, the compilation process removes most of the information not necessary for actual execution. This usually includes: comments local and global variable names local (to the program) function names any code deemed dead (not being executed in any situation) code exhibiting undefined behavior The names you are observing are Windows API names; because ...


2

find the library.zip inside the lib folder included extract EXENAME__main__.pyc (EXENAME is the name of the exe) run pip install decompyle3 run decompyle3 EXENAME__main__.pyc and the source will be printed onto the screen


2

Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example: qsnprintf(v16, v36 - v16, "[%s%c%ah]", gpPlatformStackPointerName, v20, v29); I.e. the format string that produces it is hard-coded in the binary and cannot be modified.


2

ghidra addr = toAddr(0x7ffe0000) currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0) createData(addr,getDataTypes("KUSER_SHARED_DATA")[0]) result undefined8 main(void) { wprintf((__crt_locale_pointers *)L"Version: %lu.%lu.%lu\n", (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion, ...


2

The answer to the specific question that you asked is: not directly through the UI, but it's possible with a plugin. Sample plugin #18 in the Hex-Rays SDK. The comment at the top of the plugin says: * It shows how to specify a register value at a desired location. * Such a functionality may be useful when the code to decompile is * obfuscated and uses opaque ...


2

I don't know off the top of my head if there's an option you can set for that, but that's the type of thing that's utterly trivial to write a Hex-Rays plugin for. I bet that would be less than 25 lines of code. If you can send a link to a binary, I'll write a script to demonstrate. Assuming you're writing IDAPython (the details would only be slightly ...


2

As Paweł Łukasik point out, it looks like RC4 indeed. That's especially true for the KSA that you can immediately recognize: local_14 = 0; while (local_14 < 0x100) { local_12c[local_14] = (byte)local_14; local_14 = local_14 + 1; } If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...


1

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA. You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to: ...


1

The problem, as I think you realise, is that you are logically moving the calculation of an expression past the point whereby one of its input values gets changed. Given your current implementation, I'd suggest the easiest approach to handle this is - When an instruction writes to a variable, look to see if there are any expressions involving this variable ...


1

There is no generic solution for this problem. You probably need to find the code which decides how many threads to create and see if you can reduce their number or force the processing to occur in the same thread.


1

This seems like you are effectively running into the same issue as this question: How to export a working elf binary from Ghidra? Ghidra doesn't export working ELF/PE/Mach-O files when you export something. You have to use an existing proper exporter to get a patched binary. I am not aware of one for Mach-O, especially not Mach-O with multiple architectures, ...


1

It seems it’s simply performing initialization of the VGA registers and clearing the screen buffer. The array at 318EF contains the values of the CRT controller indexed registers (ports 3D4/3D5).


1

So silly me, the function n_GetLocalPlayer() needed to be dereferenced and then the result from the offset dereferenced again. It works now. Here's the format: playerData* lpData = reinterpret_cast<playerData*>((*((DWORD *)n_GetLocalPlayer() + 280)));


1

UnityPlayer.dll is the engine itself - it doesn't contain any user-made scripts. Assembly-CSharp.dll is the main user script dll, and if, as you say, it isn't being affected, you're either modifying an unused class, or they moved to il2cpp (in which case there will be a GameAssembly.dll next to the exe) and just forgot to remove the old files.


1

In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference, function calls, etc.) citem_t has a field ea_t ea;. That field stores the address of the corresponding line in the assembly language (unless it's BADADDR, in ...


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg


1

The IEEE definition of Reverse Engineering ("Reverse Engineering and Design Recovery: A Taxonomy", IEEE, 1990) is "the process of analyzing a subject system to identify the system's components and their interrelationships and to create representations of the system in another form or at a higher level of abstraction". However, you already ...


Only top voted, non community-wiki answers of a minimum length are eligible