New answers tagged decompilation
-1
The question was a while ago, but i think the trick was to change the return type of the function "CalcCrc8"
Edit: Ghidra doesn't recognize the return type in this example. It thinks that it is void, in reality it was something else. It probably interprets a machine-instruction wrongly as a return?
So edit the return type of the function parameter ...
0
Of course there is, I will quote an example of the Pytoexe or Pyinstaller module of python that "converts" Python code to executable, or also of most JavatoExe that convert Java files to executables, what happens in reality is that a compressed executable is created , that is, your environment is copied into an executable to run, following my ...
0
You did not understand why your code is using an obfuscador, first you need to remove the obfuscador used by the developer to only then start the process of reconstructing the algorithm, use appropriate tools for this task like DIE (Detect It Easy), after discovering the name of the obfuscador look for a way to clear its torque, there are many ways for ...
1
If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA.
You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to:
...
0
You can disassemble GameAssembly.dll with GHIDRA, IDA or any other disassembler that supports x86. Decompilation is also available but nowhere near as with dnSpy because code is not C# anymore. It is C++ and you will need GHIDRA or IDA Pro if you have it to get best code decompilation.
You cannot inject managed assemblies into the compiled GameAssembly.dll. ...
1
UnityPlayer.dll is the engine itself - it doesn't contain any user-made scripts. Assembly-CSharp.dll is the main user script dll, and if, as you say, it isn't being affected, you're either modifying an unused class, or they moved to il2cpp (in which case there will be a GameAssembly.dll next to the exe) and just forgot to remove the old files.
2
I don't know off the top of my head if there's an option you can set for that, but that's the type of thing that's utterly trivial to write a Hex-Rays plugin for. I bet that would be less than 25 lines of code. If you can send a link to a binary, I'll write a script to demonstrate. Assuming you're writing IDAPython (the details would only be slightly ...
Top 50 recent answers are included
