5
votes
Accepted
How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?
Right-click on the operand, click "Manual...", enter the string "5 * 20". Note that this only works in the disassembly listing, and that there is no comparable functionality in the ...
- 9,178
4
votes
Accepted
IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text
The brown text is called as single instruction because the function, prologue of which we see in brown color, was not recognized by IDA as function.
There are many possible reasons for that, for ...
- 8,408
3
votes
i need software to decode this subtitle xml file, anyone know what it encodes with?
It's AES encrypted, but fortunately it's pretty trivial to see what's going on in the JavaScript file responsible for decoding (https://www.gohitv.com/series/js/hiplayer.min.js) by using browser ...
- 243
3
votes
Help disassembling a simple 16-bit NE function
A Typical listing in ghidra of USER!MESSAGEBOX in a 16 Bit NE Exe post analysis
LAB_1000_07f0 XREF[2]: 1000:0770(j), 1000:0775(j)
1000:07f0 ff 76 0e ...
- 16.3k
3
votes
Accepted
Help disassembling a simple 16-bit NE function
I've not looked at 16-bit windows in a while but I'd interpret the assembly as follows -
void ShowMessageBox( LPCSTR text )
{
MessageBox( NULL, // no owner window
text, // ...
- 2,503
2
votes
Decompile large function in IDA
The question is too old, but I'll answer it anyway, maybe it'll be useful for someone else.
You can change the MAX_FUNCSIZE variable in the \IDA\cfg\hexrays.cfg
The default is 64, put a bigger number. ...
- 29
2
votes
Linux Kernel for embedded platform - Available Sources but no configuration
You could try to compare the symbol tables for the custom kernel and the official kernel either by looking at the system.map file or get it from the running system via /proc/kallsyms (might need to ...
- 71
2
votes
Help disassembling a simple 16-bit NE function
As per the comment made by @blabb on his answer, I looked at the Win16 WINDOWS.H header file (from the Windows 3.1 Driver Development Kit (DDK)) to see which calling conventions were used for the ...
- 165
2
votes
Why are machine code decompilers less capable than for example those for the CLR and JVM?
As someone who has worked on a suite of Python decompilers, I have thought about this a bit.
I am going to take a different tack than other bottom-up answers; I start to describe the situation from a ...
- 213
2
votes
How to define a 28-bit integer in Ghidra
I'm not sure what exactly you want, but my best guess that defining a struct with a 28 bits long bitfield is the way to correctly model this.
- 1,401
1
vote
Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing
I'd recommend debugging the decryption loop in your code, and the encryption loop in the original binary, side-by-side and comparing the values at each step. It's possible that your binary's rand() ...
- 9,178
1
vote
Accepted
ELF - Why does objdump provide a wrong byte value in the .got?
When a ELF binary is loaded each one of its sections is loaded to a Virtual Memory Address which is different than its raw offset on disk.
Now, objdump shows the contents of the __got's as if it was ...
- 326
1
vote
How to map a decompiled c program back into original source code
Compile the original program with debug information (i.e., tell MSVC to generate a PDB, preferably a full PDB), and then use something like BinDiff or Ghidra's "Version Tracker" tool to ...
- 9,178
1
vote
Stuck decompiling ARM64 function
It looks like the code for this function is mainly taken from here. So I think if you fix up the prototypes of asin and atan2 to return angles, you should see the roll, pitch, and yaw values being ...
- 368
1
vote
Accepted
IDA Decompiler generates wrong output on array of structures!
I found the solution for this issue, and post it here hope help someone someday...
I undefined the "arr_of_struct" (Ctrl+U), undefined both the array and also the structure variable:
====&...
- 171
1
vote
How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?
At the assembly level, IDA reconstructs the instructions as seen in memory.
Constant multiplication adds an overhead of at least one additional instruction (like MUL or MLA for ARM CPUs); when a ...
- 579
1
vote
Accepted
Double constructor when reversing Unity game
Based on the discussion in comments and further investigation, when the class is instantiated like this:
TurretShootOrder turretShootOrder2 = new TurretShootOrder(firstFakeTarget, null, ....
then it ...
- 326
1
vote
What tricks can I use to manually decompile a set of instructions
you could start with something like below and then optimize it
the flow below is not tested but should provide a starting point
the code below is trying to mimic the flow of assembly and does not ...
- 16.3k
1
vote
Accepted
Decompiling and Recompiling APK leads to crash using Apktool
As commented by Robert, the answer for me in this case was that the signature was being checked by the app itself, and the app was causing the crash as a result of detecting modification to the app. ...
- 121
1
vote
Decompiling and Recompiling APK leads to crash using Apktool
You are likely working with a split-config application and you're only re-signing and installing the base APK. You need to also install additional APKs from the bundle (also known as XAPK).
Details ...
- 11
1
vote
How to Convert given set of Assembly-Level Instructions to High-Level Language Code?
For the solution of your trivial example, see the answer of @rce.
However, achieving a proper understanding of a more realistc, fairly complex assembler code and convert it into HL-code, you should be ...
- 1,964
1
vote
identify the functions of stripped binaries
The solution to this problem would probably be the use of function signatures. Most common re tools like IDA (FLIRT), ghidra and r2 (zignatures) support this. The only problem is that if the ...
- 111
1
vote
inspecting c-sky elf application
Me?
I'm hoping to be able to use the box to control the tuner, and do one of two things with it:
sample and pass the I/Q information to a network destination for demodulation.
sample and pass the I/Q ...
- 11
1
vote
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET both include a feature called "reflection", which makes it possible to access inner workings of a class and instances thereof, using runtime-generated strings that hold the ...
- 171
Only top scored, non community-wiki answers of a minimum length are eligible