Author Topic: Interactive Decompiler  (Read 10015 times)

0 Members and 1 Guest are viewing this topic.

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
Interactive Decompiler
« on: March 03, 2013, 12:57:31 pm »
The IDC tool is an interactive decompiler, where the user starts with an almost literal translation of Assembly code in C language, which he progressively decompiles by the successive application of low-level refactorings, ultimately leading to high-level C code.







Code: [Select]
http://idc.sourceforge.net/wiki/index.html
« Last Edit: March 03, 2013, 12:59:00 pm by Axon »

Offline strong115

  • /dev/null
  • *
  • Posts: 16
  • Cookies: -13
    • View Profile
Re: Interactive Decompiler
« Reply #1 on: March 05, 2013, 11:41:11 pm »
hello
 
can you tell me if this decompiler is able to provide the exact program code as it is written and what are the software that it is unable to decompile them
what are the advantages and disadvantages of this decompiler??

Offline Mordred

  • Knight
  • **
  • Posts: 360
  • Cookies: 135
  • Nvllivs in Verba
    • View Profile
Re: Interactive Decompiler
« Reply #2 on: March 06, 2013, 12:12:43 am »
I know ASM and C quite well, but I haven't actually done any decompiling of executables yet and I'm thinking about maybe going for a job within malware analysis. Would this be a great learning tool for me?
\x57\x68\x79\x20\x64\x69\x64\x20\x79\x6f\x75\x20\x65\x76\x65\x6e\x20\x66\x75\x63\x6b\x69\x6e\x67\x20\x73\x70\x65\x6e\x64\x20\x74\x68\x65\x20\x74\x69\x6d\x65\x20\x74\x6f\x20\x64\x65\x63\x6f\x64\x65\x20\x74\x68\x69\x73\x20\x6e\x69\x67\x67\x72\x3f\x20\x44\x61\x66\x75\x71\x20\x69\x73\x20\x77\x72\x6f\x6e\x67\x20\x77\x69\x74\x68\x20\x79\x6f\x75\x2e

Offline vezzy

  • Royal Highness
  • ****
  • Posts: 771
  • Cookies: 172
    • View Profile
Re: Interactive Decompiler
« Reply #3 on: March 06, 2013, 02:26:53 am »
can you tell me if this decompiler is able to provide the exact program code as it is written and what are the software that it is unable to decompile them

I have no experience with this particular tool, but I think you have high expectations in retrieving "exact program code". Decompilers in general are hit-and-miss by nature as it is very difficult to abstract machine code to a higher-level language unless the target language is compiled to an intermediary language [bytecode] which has extensive metadata, such as Java.

Depends on the decompiler itself though. If it's more sophisticated and has good type analysis, you'll yield better results.
Quote from: Dippy hippy
Just brushing though. I will be semi active mainly came to find a HQ botnet, like THOR or just any p2p botnet

Offline ca0s

  • VIP
  • Sir
  • *
  • Posts: 432
  • Cookies: 53
    • View Profile
    • ka0labs #
Re: Interactive Decompiler
« Reply #4 on: March 06, 2013, 12:55:16 pm »
Decompilers wont give you the EXACT source code of a binary, they will give you an aproximation, which quality will depend on the compiler used and what optimization flags were used. I have got results from a REALLY good decompilarion (~90% like my original code) to total garbage (I mean, reading ASM was easier than the decompiled source).

The best decompiler I've used is X-Rays (IDA), and most of the times it actually helps to understand large chunks of ASM code.

I have not tried this one, but judging from Axon's description and screenshots in its website, it seems like "more interactive". You constantly modify the decompilarion until you get a decent enough source, instead of letting the tool do all the work for you. Seems interesting, I'll try it.

Offline Mordred

  • Knight
  • **
  • Posts: 360
  • Cookies: 135
  • Nvllivs in Verba
    • View Profile
Re: Interactive Decompiler
« Reply #5 on: March 06, 2013, 01:00:00 pm »
I have not tried this one, but judging from Axon's description and screenshots in its website, it seems like "more interactive". You constantly modify the decompilarion until you get a decent enough source, instead of letting the tool do all the work for you. Seems interesting, I'll try it.

Ah nice, that's really cool for people studying this I suppose.
\x57\x68\x79\x20\x64\x69\x64\x20\x79\x6f\x75\x20\x65\x76\x65\x6e\x20\x66\x75\x63\x6b\x69\x6e\x67\x20\x73\x70\x65\x6e\x64\x20\x74\x68\x65\x20\x74\x69\x6d\x65\x20\x74\x6f\x20\x64\x65\x63\x6f\x64\x65\x20\x74\x68\x69\x73\x20\x6e\x69\x67\x67\x72\x3f\x20\x44\x61\x66\x75\x71\x20\x69\x73\x20\x77\x72\x6f\x6e\x67\x20\x77\x69\x74\x68\x20\x79\x6f\x75\x2e