5 ms·

I'm curious if the author decompiled binaries generated from C code. In that case, I understand how one could "dis assemble" binaries, but generating readable C

I'm curious if the author decompiled binaries generated from C code. In that case, I understand how one could "dis assemble" binaries, but generating readable C code, is that possible?

BuuQu9hu 10y ago
Decompilers exist (like Boomerang), but it is more likely the author used something like IDA Pro, which has a code flow graph feature. http://boomerang.sourceforge.net/ http://boomerang.sourceforge.net/
- DCoder 10y ago
  Hex-Rays is a pretty good decompiler plugin for IDA Pro: https://www.hex-rays.com/products/decompiler/index.shtml https://www.hex-rays.com/products/decompiler/index.shtml
- andreareina 10y ago
  It's IDA Pro. FTA: > So, let’s open IDA Pro!
Andoryuuta 10y ago
It's possible to an extent. The disassembler being used is a commercial product called IDA from Hex-Rays [1]. They also sell a decompiler plugin for IDA. While it can generate C-like output, it being 'readable' is debatable. Because of the lack debug symbols, compiler optimizations, and other things in release binaries, the decompiler output has some confusing characteristics. Just to name a few things: improperly guessed calling convention, odd code flow (lots of goto statements, labels, and inverted loops), messy dynamic string creation [2], bit shifts instead of multiplication/division for powers of 2, pointer arithmetic to access struct fields, stack variables reused for multiple purposes, etc. With all that being said, the Hex-Rays decompiler is the best I've seen so far. It's great to have when you want a quick overview of a function you are reverse engineering, if you or your company is willing to pay the exorbitant cost that is. Additionally, there is open source decompiler called Snowman [2] that is pretty neat also. [1] https://www.hex-rays.com/index.shtml https://www.hex-rays.com/index.shtml [2] http://reverseengineering.stackexchange.com/questions/3546/extracting-dynamically-constructed-strings-in-ida http://reverseengineering.stackexchange.com/questions/3546/e... [3] https://github.com/yegord/snowman https://github.com/yegord/snowman
- blumentopf 10y ago
  https://hopperapp.com https://hopperapp.com is just 89 €, I've found its decompiler to be sufficient in most cases.
jpalomaki 10y ago
The application is written in Ruby and the code was just slightly[1] obfuscated so there was no need to decompile the actual application he was analyzing. [1] "This obfuscation is intended to discourage GitHub Enterprise customers from making modifications to the VM. We know this 'encryption' is easily broken."

I'm curious if the author decompiled binaries generated from C code. In that case, I understand how one could "dis assemble" binaries, but generating readable C code, is that possible?

BuuQu9hu 10y ago

Decompilers exist (like Boomerang), but it is more likely the author used something like IDA Pro, which has a code flow graph feature. http://boomerang.sourceforge.net/ http://boomerang.sourceforge.net/

DCoder 10y ago
Hex-Rays is a pretty good decompiler plugin for IDA Pro: https://www.hex-rays.com/products/decompiler/index.shtml https://www.hex-rays.com/products/decompiler/index.shtml
andreareina 10y ago
It's IDA Pro. FTA: > So, let’s open IDA Pro!

Andoryuuta 10y ago

It's possible to an extent. The disassembler being used is a commercial product called IDA from Hex-Rays [1]. They also sell a decompiler plugin for IDA. While it can generate C-like output, it being 'readable' is debatable. Because of the lack debug symbols, compiler optimizations, and other things in release binaries, the decompiler output has some confusing characteristics. Just to name a few things: improperly guessed calling convention, odd code flow (lots of goto statements, labels, and inverted loops), messy dynamic string creation [2], bit shifts instead of multiplication/division for powers of 2, pointer arithmetic to access struct fields, stack variables reused for multiple purposes, etc. With all that being said, the Hex-Rays decompiler is the best I've seen so far. It's great to have when you want a quick overview of a function you are reverse engineering, if you or your company is willing to pay the exorbitant cost that is. Additionally, there is open source decompiler called Snowman [2] that is pretty neat also. [1] https://www.hex-rays.com/index.shtml https://www.hex-rays.com/index.shtml [2] http://reverseengineering.stackexchange.com/questions/3546/extracting-dynamically-constructed-strings-in-ida http://reverseengineering.stackexchange.com/questions/3546/e... [3] https://github.com/yegord/snowman https://github.com/yegord/snowman

blumentopf 10y ago
https://hopperapp.com https://hopperapp.com is just 89 €, I've found its decompiler to be sufficient in most cases.

jpalomaki 10y ago

The application is written in Ruby and the code was just slightly[1] obfuscated so there was no need to decompile the actual application he was analyzing. [1] "This obfuscation is intended to discourage GitHub Enterprise customers from making modifications to the VM. We know this 'encryption' is easily broken."