7 votes
Accepted

How to prevent Ghidra from removing unreachable blocks?

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going ...
user avatar
  • 88
5 votes

Recover source code for C# .exe

As far as free and open source tools go, I'd recommend dnSpy. It is the best tool I've used for .NET reverse engineering. You might also want to try out ILSpy, which is free and open source as well.
user avatar
  • 1,479
5 votes

How can I decompile an ARM Cortex-M0 .hex file to C++?

Short answer: You can't. At least, don't expect a readable, and compilable, C source code. There's discussion why elsewhere on this site, so i won't get into details. Also, note there's not an easy ...
user avatar
5 votes

ida decompiler output

The 0x5F3759DF constant seems familiar... It is the fast inverse square root algorithm: http://en.wikipedia.org/wiki/Fast_inverse_square_root comparing against that code SLODWORD and LODWORD would ...
user avatar
5 votes

Is there any decompiler, which can produce a compilable result?

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
user avatar
5 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
user avatar
  • 66
4 votes

Decompile ARM native binary - IDA Pro detects file as Shared Object

You'll need to create an Android Virtual Device, copy your ELF program and <IDA directory>\dbgsrv\android_server to the virtual device, and run android_server on the virtual device. You can then ...
user avatar
4 votes
Accepted

How to retrieve native asm code from .NET mixed mode dll file?

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll -rwxr-xr-x 1 Admin Administ ...
user avatar
  • 15k
4 votes

Decompiling 64bit ARMv8 Android .so library

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
user avatar
  • 7,875
4 votes

Recover source code for C# .exe

Consider also JetBrains dotPeek that is free, decompiles .NET 1.0-4.5 assemblies to C#. Has support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.
user avatar
  • 141
4 votes
Accepted

Decompile a DLL file from Microsoft Media Creation Tool

Disclaimer: The following links are for Fall Creators Update and may be change in future updates. Download the Media Creation Tool from Microsoft website. Open the executable in 7ZIP and extract all ...
user avatar
  • 1,469
4 votes

Are there any 64 bit MIPS decompilers

https://ghidra-sre.org/ Ghidra supports a lot of processors including mips64
user avatar
  • 391
3 votes

Recover source code for C# .exe

To answer your question "Can I end up with the original source code in a way I can finish the coding of the missing items and recompile again?": if it runs on your system, it means you have all the ...
user avatar
3 votes

How can I decompile an ARM Cortex-M0 .hex file to C++?

radare2 supports these ihex files directly note the command in radare2 in my original answer uses switch -b32 SYS_V commented that it should be -b16 and posted an answer with ample details how to ...
user avatar
  • 15k
3 votes

How to retrieve native asm code from .NET mixed mode dll file?

You need to select Portable executable for 80386 (PE) from the list of loaders in IDA instead of confirming the default (Microsoft.NET assembly).
user avatar
  • 34.9k
3 votes
Accepted

Could this be a Math.Min function decompiled in C?

Looks like a common pattern for ceiling to me. In other words NewSize = ceil(StartPos/MaxSize) * MaxSize, which is rounding it to the nearest multiple of MaxSize that is larger than StartPos.
user avatar
  • 146
3 votes
Accepted

Decompiling/disassembling lua bytecode

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text ...
user avatar
  • 5,860
3 votes
Accepted

Changing .SO files in android cause to damage the apk

Android APKs are signed to ensure the developer (holder of the private key) is the only person who can update the application. When the apk is signed, much like that of a jar file, hashes are taken of ...
user avatar
  • 348
3 votes
Accepted

What does this combination SCAS and STOS?

ebp points to the stack, which is where function parameters are stored. ebp+8 is your first parameter, and ebp+0C the second one. The first parameter is a pointer to a 0-terminated string, and gets ...
user avatar
3 votes

Can we decompile an .exe or .dll as %100?

Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code. There are many applications which can do that. My ...
user avatar
3 votes

Erlang Source file generation from .beam file

Have you tried using recon:source/1? I think it does exactly what you need. If you don't want to use it, at least you can get inspiration from its source code: -spec source(module()) -> iolist(). ...
user avatar
3 votes

How can I get classes from "protected" JAR file?

The obfuscator probably used the '\u0000' "exploit". This character is known as NUL terminator and its used for terminate the length of a character string in C/C++. All renamed classes will ...
user avatar
  • 141
3 votes
Accepted

Decompiling .pyc file to 0 byte .py file

It's possible that the pyc file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead. The dis module can disassemble Python ...
user avatar
  • 5,860
3 votes
Accepted

How to decompile /usr/bin/ls

From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function. So, if that's the beginning of a function (it might be) just create ...
user avatar
3 votes

How to decompile /usr/bin/ls

Kevin, ls comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during ...
user avatar
  • 1,447
3 votes

Are there any 64 bit MIPS decompilers

Mumbel is correct, Ghidra supports decompilation of MIPS64 binaries; see "What Processors are Currently Supported" in their FAQ. Here is a screenshot of decompilation of the main() function ...
user avatar
  • 6,859
3 votes

MIPS assembly to C code

It's not really working, but I'm not sure what is wrong. More information could help give more specific answers like what exactly is the behavior of the original program and what behavior is your ...
user avatar
3 votes

Decompile a NodeJS compiled program maybe by NEXE

Here is the most complete source code of this malware I can find. its malware known as piratestealer: https://github.com/teddybearsz/shitasssrcdonttouchitpleasepleaseplease/tree/...
user avatar
  • 131
3 votes

How to restore struct fields

IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did ...
user avatar
  • 7,879
2 votes
Accepted

ADC in ARM : What is the corresponding C?

There is no single C instruction that matches the assembly code directly. What's happening is the 32 bit value in r7 gets added to the 64 bit value in r2/r3, with the result written to r4/r5. You ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible