Hacker News Reader

Comment by mankash666 | Hacker News Reader

I'm curious if the author decompiled binaries generated from C code. In that case, I understand how one could "dis assemble" binaries, but generating readable C code, is that possible?

View on HN

It's possible to an extent. The disassembler being used is a commercial product called IDA from Hex-Rays [1]. They also sell a decompiler plugin for IDA. While it can generate C-like output, it being 'readable' is debatable. Because of the lack debug symbols, compiler optimizations, and other things in release binaries, the decompiler output has some confusing characteristics. Just to name a few things: improperly guessed calling convention, odd code flow (lots of goto statements, labels, and inverted loops), messy dynamic string creation [2], bit shifts instead of multiplication/division for powers of 2, pointer arithmetic to access struct fields, stack variables reused for multiple purposes, etc. With all that being said, the Hex-Rays decompiler is the best I've seen so far. It's great to have when you want a quick overview of a function you are reverse engineering, if you or your company is willing to pay the exorbitant cost that is.

Additionally, there is open source decompiler called Snowman [2] that is pretty neat also.

[1] https://www.hex-rays.com/index.shtml [2] http://reverseengineering.stackexchange.com/questions/3546/e... [3] https://github.com/yegord/snowman

https://hopperapp.com is just 89 €, I've found its decompiler to be sufficient in most cases.

The application is written in Ruby and the code was just slightly[1] obfuscated so there was no need to decompile the actual application he was analyzing.

[1] "This obfuscation is intended to discourage GitHub Enterprise customers from making modifications to the VM. We know this 'encryption' is easily broken."

Decompilers exist (like Boomerang), but it is more likely the author used something like IDA Pro, which has a code flow graph feature.

http://boomerang.sourceforge.net/

Hex-Rays is a pretty good decompiler plugin for IDA Pro: https://www.hex-rays.com/products/decompiler/index.shtml

It's IDA Pro. FTA:

> So, let’s open IDA Pro!

Reply on news.ycombinator.com