14
votes
Accepted
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
- 1,767
9
votes
Are there any interactive decompilers besides HexRays?
Short answer: No, there is no other interactive decompiler, at least not for native codes.
Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
- 4,425
9
votes
Is there a list of Ghidra's variable prefixes?
This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet.
Variable names
From Function.java:
param_
local_
local_res
temp_
From ...
- 905
8
votes
Accepted
Can AI be used to write better decompilers/disassemblers?
First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs ...
- 18.9k
6
votes
IDA decompiler macro
COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example:
COERCE_DOUBLE(__PAIR__(i1,i2))
Is the same as *(double *)&__PAIR__(i1, ...
- 111
6
votes
Decompilation techniques for DOS .COM files
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://...
- 1,060
6
votes
Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?
You can enable the auto-comment option in IDA, to have something like this:
Or also give a try to snowman, a free decompiler for IDA Pro, that is able to transform this compiled program:
#include &...
- 2,506
5
votes
Is there any decompiler, which can produce a compilable result?
Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
- 111
5
votes
Accepted
Stack-pointer analysis failed
When I assembled the code, the offending instruction was:
0x6c 40 ff d1 call rcx
You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As ...
- 1,225
4
votes
Decompiling 64bit ARMv8 Android .so library
The first tool is IDA decompiler (a plugin for IDA).
As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
- 8,353
4
votes
Accepted
IDA hex-rays decompiler not loaded
The answer is that I was trying to open a 32bit file in idaq64 and so the decompiler doesn't work.
- 228
4
votes
Accepted
Split variable in Hexrays decompiler?
I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.
However, in situations where it's really annoying, creating a ...
- 426
4
votes
Can AI be used to write better decompilers/disassemblers?
Although I initially voted to close this question as primarily opinion-based, given both answers side with the same general answer ("No!") I'll answer as well. I just love being the devil's advocate.
...
- 11.7k
4
votes
Is PNF's JEB Reverse Engineering platform written in pure Java?
There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
- 11.7k
4
votes
Decompile a NodeJS compiled program maybe by NEXE
Here is the most complete source code of this malware I can find. its malware known as piratestealer: https://github.com/teddybearsz/shitasssrcdonttouchitpleasepleaseplease/tree/...
- 141
3
votes
Can AI be used to write better decompilers/disassemblers?
No!
Reason is that AI is dumb, much more than you think it is. All it can do is matching patterns to predetermine output. And here are two main problem to use it to decompile code or to recreate "...
- 39
3
votes
Accepted
Tools to translate x86-64 ELF to PPC (or i386 decompilation)
For 1, there is QEMU which can be built for PPC and supports i386 and x86-64 emulation. If you run Linux, there may already be a precompiled package available for your distro.
For 2, there are some ...
- 36.2k
3
votes
Can we decompile an .exe or .dll as %100?
Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code.
There are many applications which can do that.
My ...
- 176
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare.
...
- 3,188
3
votes
Edit codes in .Net Reflector with Reflexil (Compile Window)
Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...:
https://www.youtube.com/watch?v=...
- 20.6k
3
votes
Accepted
Decompile Python for ELF Binaries
It can be said with certainty that your binary has been compiled with PyInstaller. Searching for the string "Error detected starting Python VM." leads to the PyInstaller repo.
Now that you know it's ...
- 6,030
3
votes
Accepted
How do I make a hex literal a decimal literal in Ghidra?
Right click on the number
Convert -> Unsigned Decimal:
- 932
3
votes
Template code with 0xcccccccc in every ghidra decompiled function for some executables
0xCC stands for int 3 in x86 architecture, that is a special interrupt used to implement software breakpoint by debuggers.
So, this code sets the memory to int 3 interrupts for debugging purposes. ...
- 3,369
3
votes
Template code with 0xcccccccc in every ghidra decompiled function for some executables
This is probably code compiled by Visual C++ in debug build setting. In such case, the compiler generates code which fills all stack variables with the byte 0xCC, so that any uninitialized value is ...
- 36.2k
3
votes
Can I decompile a file if I have a compiler?
No. In most cases, you cannot obtain the actual source code just because you have the compiler available.
However, it depends on the language. If the source code was written in .NET, for example, a ...
- 233
3
votes
Accepted
How to decompile /usr/bin/ls
From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function.
So, if that's the beginning of a function (it might be) just create ...
- 4,752
3
votes
How to decompile /usr/bin/ls
Kevin,
ls comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during ...
- 1,767
3
votes
Can obfuscation be applied on certain parts?
Multiple .dex files are created mostly in cases when the number of methods exceed the maximum one for .dex files, which is 65536 functions per file.
Yes, ProGuard can be used to obfuscate only ...
- 696
3
votes
What does Ghidra mean by ._0_3_?
you need to check the relevant disassembly and retype variable
this is basically due to size difference between variable (truncation , casting ) etc
in the screenshot above uvar15 is a ULONGLONG a64 ...
- 16.2k
2
votes
Accepted
Recognize certain components in the compiler produced assembly program
TL;DR: Hope for some magic numbers, or string constants you can xref, or you're in for a lot of manual work.
Searching for an arithmetic statement that doesn't include a very specific magic number, ...
- 12.9k
Only top scored, non community-wiki answers of a minimum length are eligible