8 ms·
Dogbolt Decompiler Explorer
- T3RMINATED 3y agonice
- dang 3y agoRelated: Decompiler Explorer - https://news.ycombinator.com/item?id=32079227 https://news.ycombinator.com/item?id=32079227 - July 2022 (82 comments)
- Arch-TK 3y agoHexRays online? Is that allowed?
- sonicanatidae 3y agoNot anymore! angrily writes a letter to his congressman who won't understand a word of it
- quickthrower2 3y agoYour congressman doesn’t yet have hexrays to decompile your letter
- exikyut 3y agoHis brain is relegated to spewing out the Matrix unparsed as he receives it. He gets none of the blondes, brunettes or redheads.
- sonicanatidae 3y agoFrom what I can tell in observation, they don't parse English either.
- rychco 3y agoWhen this first came out a year(ish?) ago, I remember seeing somewhere that they had received permission from Hexrays/Ilfak Guilfanov.
- alright2565 3y agoFrom the FAQ, Hex-Rays actually sponsors the project: > Vector 35 and Hex-Rays jointly sponsor the hosting on Digital Ocean as a community service.
- cristeigabriel 3y agoIt makes sense, it's a perfect advertisement of their superiority.
- Fabricio20 3y agoIndeed, looking at the samples HexRays really did a great job compared to the others, much more readable code.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- cristeigabriel 3y agoVery nice. A parallel, I've been working on an emulator project recently, implementing my own disassembler, and I keep thinking about how I would turn patterns of machine code into a generalized form, which could then be turned into something like C-like pseudo-code, so it's been really compelling me lately to implement my own toy decompiler
- withzombies 3y agoBinaryNinja does this. They have several layers of intermediate representations[1], which they build their compiler on top of. Ghidra does something similar with their PCode. They disassemble to PCode and then decompile the PCode[2]. [1] https://docs.binary.ninja/dev/bnil-overview.html https://docs.binary.ninja/dev/bnil-overview.html [2] https://riverloopsecurity.com/blog/2019/05/pcode/ https://riverloopsecurity.com/blog/2019/05/pcode/ (an example)
- cristeigabriel 3y agoThanks for sharing!
- Lwafezwa 3y ago[flagged]
- danielwmayer 3y agoThe name of this is a reference to the incredibly useful godbolt compiler explorer. If you are interested in this you will likely enjoy the other as well: https://godbolt.org/ https://godbolt.org/
- reaperman 3y agoIt might also be a bit of a portmanteau with a second reference to dogpile.com which was a pre-Google "search engine" that compiled search results from multiple search engines. Back in the day you often had to separately search altavista.com, lycos.com, askjeeves.com, yahoo.com, etc. because some of them would work for your query but others would not and it was difficult to predict the performance of any particular search engine, but usually at least one of them would have the result you wanted/needed. Dogpile was an automated way to search all of the search engines at the same time with one query. https://web.archive.org/web/19990429194414/http://dogpile.com/ https://web.archive.org/web/19990429194414/http://dogpile.co...
- psifertex 3y agoI do remember dogpile, but as one of the folks who named it, nope, that wasn't a conscious influence!
- codetrotter 3y agoLook no further than https://dogbolt.org/faq https://dogbolt.org/faq > It's meant to be the reverse of the amazing Compiler Explorer. With a link to https://godbolt.org/ https://godbolt.org/ It’s very obvious that Dogbolt Decompiler Explorer is primarily named after Godbolt Compiler Explorer.
- iBotPeaches 3y agoLove this - I can almost imagine the convincing for other companies wasn't even needed when they realized a small binary size and comparison to competitors would net them more business. A perfect little solution for triaging issues between services and comparing solutions.
- psifertex 3y agoThat was indeed the logic. The two main commercial solutions included (Binary Ninja made by Vector 35, where I'm one of hte founders) and Hex-Rays both pay for all the hosting costs. And it's not particularly cheap -- there's a fair amount of compute to drive the decompilers especially as some of them are... not very efficient.
- rixtox 3y agoI really wish a similar tool for exploring binary lifting to different IRs. Like Ghidra p-code with sleigh, LLVM Machine IR, Qemu TCG etc
- psifertex 3y agoIRs aren't generally suited toward small snippets of examination by human when you're starting with a full binary. I would imagine something like that would only work well when done for very small bits of assembly. Likewise, you might be interested in BNIL which is an entire stack of ILs that Binary Ninja is based on. (You can see it exposed in the cloud.binary.ninja UI or the demo)
- JonChesterfield 3y agoQemu works by translating a binary to an IR then doing stuff with it. Valgrind likewise. There's an optimiser called bolt (associated with facebook) which has the same idea.
- psifertex 3y agoYup, I'm aware of both of those, but none of those tools listed so far are intended for the IR to be for human-consumable unlike disassemblers and decompilers. You think disassembly is verbose compared to a decompiler? Go look at the equivalent Vex (Valgrind's IR) for any non-trivial disassembly. It's suuuper verbose. As far as I know, BNIL (https://docs.binary.ninja/dev/bnil-overview.html https://docs.binary.ninja/dev/bnil-overview.html) is the only one that is designed to be readable and it still wouldn't make sense to include it in an IL comparison such as the one done here for decompilation in my opinion.
- hoosieree 3y agoWow, I really could have used this for my Ph.D. research (deep learning for obfuscated code). I ditched Ghidra in my experiments in favor of angr early on because Ghidra did not play nicely with multiprocessing and I had a lot of data to process. Well maybe it does but it was much easier for me to achieve the same thing with angr. Love the name! Although I feel compelled to point out that Compiler Explorer is the name of the project and Godbolt is its author's last name, but I suppose if people are to the point of using Godbolt as a verb the ship has sailed.
- psifertex 3y agoWe know! Similarly, the GH repo is actually the Decompiler Explorer: https://github.com/decompiler-explorer/decompiler-explorer/ https://github.com/decompiler-explorer/decompiler-explorer/
- account42 3y agoI like the name, it's cute and a nice homage.
- tomcam 3y agoSometimes we must look back in angr
- mvelbaum 3y agoHas there been any good progress in deobfuscating/decompiling machine code using Machine Learning techniques?
- w10-1 3y agoOMG I am so happy Of note: HexRays is not only cleaner, but right now their queue is mostly empty while others are backed up.
- psifertex 3y agoBinary Ninja likewise is empty and keeps up just fine as well. It's not a coincidence that the two commercial products that are funding it are both confident enough to put their stuff online like this. And it's no conspiracy theory or intentional sandbagging, you can see the implementation: https://github.com/decompiler-explorer/decompiler-explorer https://github.com/decompiler-explorer/decompiler-explorer and if anyone can improve the other tools performance we'd be happy to accept it. We reached out to the Ghidra devs: https://github.com/NationalSecurityAgency/ghidra/issues/5228 https://github.com/NationalSecurityAgency/ghidra/issues/5228 but they didn't have any silver bullets for us either.
- Carbocarde 3y ago> All submitted binaries are saved and made available to any of the authors of the tools used so they may improve their decompilers. If you're such an author who would like access, let us know!. oof
- CaliforniaKarl 3y agoGood that this is clearly mentioned up-front on their site.
- deleted 3y ago[deleted]
- einpoklum 3y agoIf you believe that content you submit to websites is not examined by interested parties associated with that website, then - I have a bridge to sell you... or perhaps I should say a Google account to give you, free of charge.
- Carbocarde 3y agoCompare this policy to godbolt’s policy: > In short: your source code is stored in plaintext for the minimum time feasible to be able to process your request. After that, it is discarded and is inaccessible. In very rare cases your code may be kept for a little longer (at most a week) to help debug issues in Compiler Explorer.
- saagarjha 3y agoPretty sure links work basically forever
- extraduder_ire 3y agoI think they changed it recently, but all of the code you submit is embedded in the URL. (after an anchor) So, it's stored by google's link shortening service, but is resubmitted to the site every time you load it.
- 29athrowaway 3y agoNow take the output of dogbolt and feed into godbolt.
- staunton 3y agoAnd reinforcement-train an LLM to reconstruct the original code...
- 29athrowaway 3y agoThat would be dogebolt
- userbinator 3y agoMachine translation, for machine code. Theoretically, a fixed point should be reached.
- fritzo 3y agoIs there a similar project for javascript? That is, de-obfuscating large javascript codebases?
- intelVISA 3y ago> de-obfuscating large javascript codebases Impossible, sadly.
- psifertex 3y agoCan I just say, thanks to the person who posted this for waiting until this week to do so. (Side note: I suspect it was due to the recent coverage from C++ Weekly which is a great resource: https://www.youtube.com/watch?v=h3F0Fw0R7ME https://www.youtube.com/watch?v=h3F0Fw0R7ME) As recently as last week we had some horrible performance problems but it looks like the queue (https://dogbolt.org/queue https://dogbolt.org/queue) is mostly still fine! Other than the long pole of a few of the decompilers being backed up, things are humming along quite smoothly! Josh + Glenn have done some great work on it! (https://github.com/decompiler-explorer/decompiler-explorer/commits/master https://github.com/decompiler-explorer/decompiler-explorer/c...)
- costco 3y agoI wish I saw this when it was posted last year. This is awesome and really convenient.
- aidenfoxivey 3y agoSpeaking of decompilers, would Binary Ninja be a safe bet to pick? I've been told IDA is the gold standard, but it's also expensive for someone who wants to recreationally reverse engineer.
- IAmLiterallyAB 3y agoHonestly just use Ghidra. It has it's quirks but it's pretty good. And open source. If it's good enough for the NSA it's probably good enough for recreational use.
- codedokode 3y agoIf Ghidra is made by NSA, does it mean that it can have backdoors for non-US users?
- dddnzzz334 3y agoThe code is open source and has been looked at by several people over the years. It would be quite hard for the NSA to sneak in a backdoor but it is never out of the question. However, the risk is so extremely minuscule when compared to other alternatives since they are not even open source.
- kdbg 3y agoBinja decompiler is more-or-less fine. Its not as mature as IDA or Ghidra but its not a bad decompiler. Though for me the big selling point on Binja is the Intermediate Languages (ILs). HIgh-level IL is the decompiler but you also get Low-level and Medium-level ILs as steps between assembly and source. If the decompiler is a bit funky you can look at the ILs to get a better idea of what is happening. the ILs are also just much nicer to read than plain assembly so I tend to use them a lot. Its a feature that isn't really matched on any other platform. Ghidra and IDA both have a single IL that is more machine readable compared to Binja's human-readable ones.
- gavinray 3y agoIDA Free has essentially all the features of Pro nowadays, if you're only looking to do x86_64 on Windows/Linux. https://hex-rays.com/ida-free/ https://hex-rays.com/ida-free/ The only thing you lose out on is Python scripting, which is kind of big, but for a free tool you really can't complain. You probably want to use both IDA and Ghidra since they have different strengths/weaknesses and community plugins.
- DrNosferatu 3y agoAny good and thorough decompiler tutorials for non-expert users?
- DrNosferatu 3y agoThere seems to be demand! - Anyone care to give some pointers?
- dfawcus 3y agoI threw some 16 bit files at it, all of them puked in one way or another. One was a CP/M-86 "small model" executable, the other an object file (16 bit intel OMF object file) - i.e. compiler output. Boomerang looked like it'd have most chance of getting somewhere since it mentioned having a DOS .EXE analyser. I'm surprised that "Hex Rays" (i.e. IDA-Pro) got nowhere...