3 ms·
Just for reference, here is what the Hex-Rays decompiler produces for the function in question: https://ghostbin.com/paste/jpeh5 https://ghostbin.com/paste/jpe
by comex 9y ago
Just for reference, here is what the Hex-Rays decompiler produces for the function in question:
https://ghostbin.com/paste/jpeh5 https://ghostbin.com/paste/jpeh5
Not as readable or semantically meaningful as the author's manually decompiled version, but pretty decent.
So if you think x86 assembly sounds really arcane, you should know that you're not strictly required to learn it to start experimenting with reverse engineering: you can start with a decompiler, which is all you need in most cases, and gradually learn how its output corresponds to assembly (which is still necessary to deal with in harder cases). Hex-Rays is the only decompiler I know that doesn't suck, and you are required to fork out high sums to get a legitimate copy of it… but it's easy enough to find a non-legitimate copy to start out with.
Personally, even though I have a fair amount of experience with reverse engineering at the assembly level, I find that using the decompiler lets me understand the "big picture" of a function's purpose much more quickly. Maybe I just need even more experience, and I'd be able to work just as fast from assembly… but I don't think so. I'd rather write my own decompiler to handle the stuff that Hex-Rays doesn't.
- jlgaddis 9y ago> ... you should know that you're not strictly required to learn it to start experimenting with reverse engineering ... +1. The only assembly I ever learned was some 6502 assembly many, many years ago, and I didn't even learn that very well. But that didn't prevent me from later figuring out how to "crack" a bunch of BBS door games (with SoftICE for DOS) as a teenager. Hell, I'm not even a real programmer, and I was successful in bypassing the license protections on a (Linux) binary from Cisco a few years ago (although, ultimately, that was just NOP'ing out a "jump") using IDA Pro. That took me maybe 30 minutes to do. Thanks, +Fravia! [0] I am very far from an expert on this stuff but I think that getting started is waaaay easier than people believe. (N.B.: IDA Pro runs on Windows but even works on (Linux) ELF binaries.) [0]: https://en.wikipedia.org/wiki/Fravia https://en.wikipedia.org/wiki/Fravia
- jcranmer 9y agoThe newest versions of IDA Pro run on Linux and OS X as well.
- Fnoord 9y agoAnd its bloody expensive for hobbyist usage [1]. 5.0 is free for non-commercial use but lacks all the features from 6.x and 7.x including Linux and macOS port. [1] https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
- jlgaddis 9y agoUse 5.0 to reverse engineer 7.x and bypass the licensing? :)
- cure 9y agoAh, Fravia... Yes, his site was indeed a goldmine and I have fond memories of the many things I learned there in the 90's. Curiously enough, the wikipedia page does not mention that part of the mystery of Fravia's site was that he kept his identity a secret.