18

As 0xea said, the .so file are just regular executable files but packed in a dynamic library style. I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools. Extract the functions from the library A first step will be to extract the name of all ...


7

If your application is compiled to a binary you might still be able to use normal debuggers like IDA. However, Lua has its own tools for decompiling from machine code and byte code. These links should be kept up to date by the Lua community. Lua Wiki: LuaTools If you need support for Lua 5.2 LuaAssemblyTools is the first to support that.


7

By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going to Edit -> Tools Options. This would bring you to a page as seen in the screenshot below Under the Analysis options in the Decompiler folder, there is a ...


6

First thing that comes to mind is the following approach Using your favourite debugger/disassembler locate the function and note down some unique byte pattern which identifies the function (Sort of like IDA's Flirt signatures) Get a handle to the DLL (GetModuleHandleA) Get the image size (from MODULEINFO.SizeOfImage using GetModuleInformation) Search for ...


6

Linux shared object files are ELFs too! Any decompiler that works on "regular" ELF files will work for SO files too. That said, you can use IDA Pro to disassemble them as usual. If you have IDA Pro licence with Hex-rays decompiler, you can use that. If you don't have Hex-rays, you can try ida-decompiler plugin to get some results. It's open source, but is ...


5

The 0x5F3759DF constant seems familiar... It is the fast inverse square root algorithm: http://en.wikipedia.org/wiki/Fast_inverse_square_root comparing against that code SLODWORD and LODWORD would be a bit-preserving conversion to an integral type. The last line does a1*invsqrt(a1) which is equal to sqrt(a1) * (sqrt(a1)/sqrt(a1)) so it ends up ...


5

you can use hteditor by seppel if disassembly is ok http://hte.sourceforge.net/ copy the .so file from linux machine with say samba and feed the so file to hteditor a sample using libc.so.6 from a damn small linux assuming samba is up and running in vm and a shared folder in windows host is created say c:\sharedwithvm from the linux machine cp ...


5

The primary purpose of decompilation is not to produce code that is compiled back with no errors, but rather recover logical flow of a binary. Hex-Ras Decompiler comes with its own set of limitation noted in Hex-Rays Decompiler Manual, to mention few: Below are the most important limitations of our decompilers (all processors): * exception handling is ...


5

As far as free and open source tools go, I'd recommend dnSpy. It is the best tool I've used for .NET reverse engineering. You might also want to try out ILSpy, which is free and open source as well.


4

You'll need to create an Android Virtual Device, copy your ELF program and <IDA directory>\dbgsrv\android_server to the virtual device, and run android_server on the virtual device. You can then use IDA to debug the ELF file. Here are two pages with detailed instructions on how to do this: A Guide to Debugging Android Binaries Debugging Android ...


4

Short answer: You can't. At least, don't expect a readable, and compilable, C source code. There's discussion why elsewhere on this site, so i won't get into details. Also, note there's not an easy walk-through or how-to. You need to experiment, and you'll need some experience as well. To get you started, you might: convert the .hex file into a raw ...


4

Consider also JetBrains dotPeek that is free, decompiles .NET 1.0-4.5 assemblies to C#. Has support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.


4

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs additional money and should be purchased separately). The second is hopper which has much weaker decompiler and claims to be able to decompile arm64. There is also a ...


4

https://ghidra-sre.org/ Ghidra supports a lot of processors including mips64


3

radare2 supports these ihex files directly note the command in radare2 in my original answer uses switch -b32 SYS_V commented that it should be -b16 and posted an answer with ample details how to proceed from the end of my answer to a tangible result here is the link to that thread how to find usefull info from a bin file :\>ls -l total 172 -rw-rw-rw- ...


3

The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method E:\1dll>ls -l 1.dll -rwxr-xr-x 1 Admin Administ 268288 Dec 24 15:27 1.dll E:\1dll>rahash2 -a md5 1.dll 1.dll: 0x00000000-0x000417ff md5: 82eab591d8bc6d293a2a07f10a5f6a46 E:\1dll>"c:\Program Files\Microsoft SDKs\...


3

ebp points to the stack, which is where function parameters are stored. ebp+8 is your first parameter, and ebp+0C the second one. The first parameter is a pointer to a 0-terminated string, and gets loaded into edi. The repne scasb instruction will increment edi, and decrement ecx, until either ecx is zero or edi points to a byte that is equal to the one in ...


3

Android APKs are signed to ensure the developer (holder of the private key) is the only person who can update the application. When the apk is signed, much like that of a jar file, hashes are taken of all the files. What is likely happening is that you are modifying a file and not resigning the application - this will cause the package manager to reset due ...


3

I don't have an actual answer. I've heard some rumors of a tool doing that but haven't seen anything concrete. I have, however, found a page which should be pretty helpful: Understanding C parsers generated by GNU Bison This document is an attempt to describe the implementation of an LALR(1) parser in C as generated by Bison 2.3. I used a simple ...


3

Looks like a common pattern for ceiling to me. In other words NewSize = ceil(StartPos/MaxSize) * MaxSize, which is rounding it to the nearest multiple of MaxSize that is larger than StartPos.


3

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text mode. Try the following code and see if there are any errors f = io.open("stringdumped.txt", "wb") --Note that file is opened in binary mode f:write(string.dump(...


3

To answer your question "Can I end up with the original source code in a way I can finish the coding of the missing items and recompile again?": if it runs on your system, it means you have all the dependencies needed and you'll be able to decompile to a state where you can edit and recompile at will. I don't know about Reflector, but with ILSpy, you have ...


3

Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code. There are many applications which can do that. My favourite is dnSpy since it's free, open source and has debugging functionalities. AFAIK it can even try to build a Visual Studio Solution (.sln) file from your ...


3

Have you tried using recon:source/1? I think it does exactly what you need. If you don't want to use it, at least you can get inspiration from its source code: -spec source(module()) -> iolist(). source(Module) -> Path = code:which(Module), {ok,{_,[{abstract_code,{_,AC}}]}} = beam_lib:chunks(Path, [abstract_code]), erl_prettypr:format(...


3

Disclaimer: The following links are for Fall Creators Update and may be change in future updates. Download the Media Creation Tool from Microsoft website. Open the executable in 7ZIP and extract all the files in a folder. Then download Strings from Sysinternals and place it in that previous folder whre you've extracted files. Open Command Prompt in that ...


3

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.


3

The obfuscator probably used the '\u0000' "exploit". This character is known as NUL terminator and its used for terminate the length of a character string in C/C++. All renamed classes will contain that character, this will confuse tools like 7Zip, WinRar etc.. Quick explanation: ======= Original file names: Main.class Main2.class Main3.class ...


3

From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function. So, if that's the beginning of a function (it might be) just create it by pressing F (or right click, Create Function) while your cursor is on the line that is the beginning of this function. After that the decompiler view should ...


3

Kevin, ls comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during compilation). Anyways, coming back to your question, assuming you want to decompile /usr/bin/ls (that's what I get from your comments on Pawel's answer), then open ...


3

Mumbel is correct, Ghidra supports decompilation of MIPS64 binaries; see "What Processors are Currently Supported" in their FAQ. Here is a screenshot of decompilation of the main() function of readelf compiled to target MIPS64 architecture:


Only top voted, non community-wiki answers of a minimum length are eligible