13 votes
Accepted

Why do reversers nowadays reverse engineer using decompilers and not disassemblers?

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in ...
user avatar
  • 1,437
9 votes

Are there any interactive decompilers besides HexRays?

Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other ...
user avatar
  • 4,315
8 votes
Accepted

Can AI be used to write better decompilers/disassemblers?

First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs ...
user avatar
  • 18.1k
7 votes
Accepted

Hash algorithm written in C decompiled with IDA

-1640531527 is hexadecimal '0x9e3779b9'. This number is used in boost hash function. The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part. I think ...
user avatar
  • 7,720
7 votes

Is there a list of Ghidra's variable prefixes?

This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet. Variable names From Function.java: param_ local_ local_res temp_ From ...
user avatar
6 votes

IDA decompiler macro

COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example: COERCE_DOUBLE(__PAIR__(i1,i2)) Is the same as *(double *)&__PAIR__(i1, ...
user avatar
6 votes

Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?

You can enable the auto-comment option in IDA, to have something like this: Or also give a try to snowman, a free decompiler for IDA Pro, that is able to transform this compiled program: #include &...
user avatar
  • 2,486
6 votes

Hash algorithm written in C decompiled with IDA

Some more low-level details: What is the purpose of (*(_BYTE *)(content + 7) << 24) isn't a byte only 8 bits, so won't it be 0 every time? In C, shifts implicitly promote the operand to at ...
user avatar
  • 61
6 votes

Decompilation techniques for DOS .COM files

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool: https://...
user avatar
5 votes

Decompilation techniques for DOS .COM files

IDA Pro and a number of other disassemblers will disassemble your file, assuming that it isn't compressed or otherwise obfuscated. But this is only the first step in producing a working assembly ...
user avatar
5 votes

Is there any decompiler, which can produce a compilable result?

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
user avatar
5 votes
Accepted

Stack-pointer analysis failed

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As ...
user avatar
4 votes

Decompiling 64bit ARMv8 Android .so library

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs ...
user avatar
  • 7,720
4 votes

Decompilation techniques for DOS .COM files

I recently found a DOS program which turns .COM and .EXE into a simple "pseudo-code". The program is --- exe2c.zip http://www.codeforge.com/dlpre/201558/cb2e19437871.zip__.html Not an "excellent"...
user avatar
  • 151
4 votes

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

if( (__PAIR__(a4, a3) & 0x8000000000000000ui64) == 0i64 ) becomes if(a4 >= 0 && a3 >= 0) No, that's not correct. The correct simplification is: if ((int)a4 >= 0) if ( (...
user avatar
4 votes

Hash algorithm written in C decompiled with IDA

Just a small addition to the previous answers. The following shift construct, asked in 3, is a widely used way to convert a byte stream into a 32-bit integer. (*(_BYTE *)(content + 7) << 24) ...
user avatar
  • 1,731
4 votes

What does __PAIR__ mean in Hex-Rays decompiler output?

__PAIR__() seems to be a macro that computes an unsigned long value from its two arguments, which it interprets as containing the high and low bits of that value. The topic linked by Guntram - ...
user avatar
  • 1,960
4 votes
Accepted

IDA hex-rays decompiler not loaded

The answer is that I was trying to open a 32bit file in idaq64 and so the decompiler doesn't work.
user avatar
4 votes

Can AI be used to write better decompilers/disassemblers?

Although I initially voted to close this question as primarily opinion-based, given both answers side with the same general answer ("No!") I'll answer as well. I just love being the devil's advocate. ...
user avatar
  • 11.4k
4 votes

Is PNF's JEB Reverse Engineering platform written in pure Java?

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing ...
user avatar
  • 11.4k
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...
user avatar
  • 2,918
3 votes

Edit codes in .Net Reflector with Reflexil (Compile Window)

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=...
user avatar
3 votes

Why my Resource Hacker doesn't work with some .EXE files

Parsing PE files correctly is hard and there are almost always ways to make tools crash or refuse to work, while the Windows loader still executes the program normally. See e.g. Pimp My PE, ...
user avatar
3 votes

Can we decompile an .exe or .dll as %100?

Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code. There are many applications which can do that. My ...
user avatar
3 votes
Accepted

Tools to translate x86-64 ELF to PPC (or i386 decompilation)

For 1, there is QEMU which can be built for PPC and supports i386 and x86-64 emulation. If you run Linux, there may already be a precompiled package available for your distro. For 2, there are some ...
user avatar
  • 34.8k
3 votes
Accepted

Split variable in Hexrays decompiler?

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a ...
user avatar
3 votes

Can AI be used to write better decompilers/disassemblers?

No! Reason is that AI is dumb, much more than you think it is. All it can do is matching patterns to predetermine output. And here are two main problem to use it to decompile code or to recreate "...
user avatar
  • 39
3 votes
Accepted

Decompile Python for ELF Binaries

It can be said with certainty that your binary has been compiled with PyInstaller. Searching for the string "Error detected starting Python VM." leads to the PyInstaller repo. Now that you know it's ...
user avatar
  • 5,850
3 votes
Accepted

How do I make a hex literal a decimal literal in Ghidra?

Right click on the number Convert -> Unsigned Decimal:
user avatar
3 votes

Template code with 0xcccccccc in every ghidra decompiled function for some executables

0xCC stands for int 3 in x86 architecture, that is a special interrupt used to implement software breakpoint by debuggers. So, this code sets the memory to int 3 interrupts for debugging purposes. ...
user avatar
  • 3,189

Only top scored, non community-wiki answers of a minimum length are eligible