15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array. Here is the output after this change: _this->ConfigSpace1 = configSpaceBuffer[1]; _this->ConfigSpace0 = configSpaceBuffer[0]; ...


13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


9

Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other decompilers for native code that I know (I'm not talking about Java or .NET) were created as batch tools. The closest to a half interactive decompiler is Snowman, but ...


9

IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try: REC - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' command, so YMMV. Retargetable Decompiler - This is an online decompiler that supports various architectures, including MIPS. It's OK at getting a general idea of ...


8

First, you cannot answer to this question without having to define what you mean by AI... Because this is probably the worst name for a domain in computer science. Where people think about "programs mimicking human reasoning", the reality is more about "automated heuristics to recognize patterns in tons of samples"... So, I will take the more accurate ...


7

-1640531527 is hexadecimal '0x9e3779b9'. This number is used in boost hash function. The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part. I think that it is a good point to start googling from. As far as I can say it is probably intermediate variant(lookup2) of Jenkins Hash


6

COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example: COERCE_DOUBLE(__PAIR__(i1,i2)) Is the same as *(double *)&__PAIR__(i1, i2), but since & can not be applied to calls, we end up seeing COERCE. Its name correctly conveys its meaning.


6

Some more low-level details: What is the purpose of (*(_BYTE *)(content + 7) << 24) isn't a byte only 8 bits, so won't it be 0 every time? In C, shifts implicitly promote the operand to at least an int/unsigned int, so the _BYTE value gets promoted to an unsigned int. This is probably because most processors support shifts on a single word size and ...


6

You can enable the auto-comment option in IDA, to have something like this: Or also give a try to snowman, a free decompiler for IDA Pro, that is able to transform this compiled program: #include <stdio.h> int main() { printf("Hello, World!\n"); return 0; } into int64_t main() { puts("Hello, World!"); return 0; }


6

This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet. Variable names From Function.java: param_ local_ local_res temp_ From database.cc <-- this function has most (maybe all?) of the variable naming logic. There are multiple pieces of this function that I don't yet understand; I'm ...


5

Try C4Decompiler and REC Studio 4.


5

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As per IDA documentation: This command allows you to specify how the stack pointer (SP) is modified by the current instruction. You cannot use this command if ...


4

The only MIPS decompiler I know is REC. There is also this, but I didn't try it myself.


4

if( (__PAIR__(a4, a3) & 0x8000000000000000ui64) == 0i64 ) becomes if(a4 >= 0 && a3 >= 0) No, that's not correct. The correct simplification is: if ((int)a4 >= 0) if ( (__PAIR__(v17, v12) & 0x8000000000000000ui64) != 0i64 ) { should look like this if( v17 < 0 || v12 < 0 ) { Nope, it should look like this: ...


4

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool: https://sourceforge.net/projects/decompiler/ Use the following command with the command-line tool to decompile COM programs: decompile --default-to ms-dos-com myprog....


4

__PAIR__() seems to be a macro that computes an unsigned long value from its two arguments, which it interprets as containing the high and low bits of that value. The topic linked by Guntram - Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better contains a definition for the macro and examples of its use, but no explanation of it. // ...


4

Just a small addition to the previous answers. The following shift construct, asked in 3, is a widely used way to convert a byte stream into a 32-bit integer. (*(_BYTE *)(content + 7) << 24) + (*(_BYTE *)(content + 6) << 16) + (*(_BYTE *)(content + 5) << 8) + *(_BYTE *)(content + 4) 31 24 23 16 15 8 7 0 ...


4

The first tool is IDA decompiler (a plugin for IDA). As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see here for more details, each of them costs additional money and should be purchased separately). The second is hopper which has much weaker decompiler and claims to be able to decompile arm64. There is also a ...


4

The answer is that I was trying to open a 32bit file in idaq64 and so the decompiler doesn't work.


4

Although I initially voted to close this question as primarily opinion-based, given both answers side with the same general answer ("No!") I'll answer as well. I just love being the devil's advocate. A general stance This question is very difficult to answer. As someone who came from the security field and had worked on quite a few machine learning related ...


4

There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing it in Java makes sense. However, this question is not really about reverse engineering.


3

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. However, Today I would recommend Telerik's JustDecompile though as it has built in de-obfuscation (de4dot) and has an option to replace a section with code which is ...


3

Decompile a function with .NET Reflector, and in the Instructions tab of the Reflexil window, right click on an instruction and choose Replace all with code...: https://www.youtube.com/watch?v=XaWtoCmOGpw#t=1m40s


3

IDA Pro and a number of other disassemblers will disassemble your file, assuming that it isn't compressed or otherwise obfuscated. But this is only the first step in producing a working assembly language program, which you will need if you are to translate it into a higher language. Essentially you are looking at two projects. The first is to produce a ...


3

Parsing PE files correctly is hard and there are almost always ways to make tools crash or refuse to work, while the Windows loader still executes the program normally. See e.g. Pimp My PE, Undocumented PECOFF A loop in the resource tree structure might be enough to crash Resource Hacker. Although these papers are mainly about malicious files, this applies ...


3

Since the compilation output of .NET languages is MSIL, which is quite readable itself, it can be transformed back to (almost) original source code. There are many applications which can do that. My favourite is dnSpy since it's free, open source and has debugging functionalities. AFAIK it can even try to build a Visual Studio Solution (.sln) file from your ...


3

For 1, there is QEMU which can be built for PPC and supports i386 and x86-64 emulation. If you run Linux, there may already be a precompiled package available for your distro. For 2, there are some decompilers which can produce C pseudocode from x86-64 binaries. Alternatively, tools like McSema can perform lifting to LLVM bitcode which can then be ...


3

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful. Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut). In ...


3

No! Reason is that AI is dumb, much more than you think it is. All it can do is matching patterns to predetermine output. And here are two main problem to use it to decompile code or to recreate "readable" source code: This matching isn't perfect. For example if you have mov, eax 0x10 it could be interpreted as i=8; as AI didn't have this particulate ...


3

It can be said with certainty that your binary has been compiled with PyInstaller. Searching for the string "Error detected starting Python VM." leads to the PyInstaller repo. Now that you know it's PyInstaller, you can have a look here which describes how PyInstaller works and how the binary is packaged. In short, here are the important parts Two kinds ...


Only top voted, non community-wiki answers of a minimum length are eligible