Decompilation Resources

This page contains links to projects peripherally related to decompilation.

Binary files

• Information on the internal format of binary files at the Wotsit's File Format Collection.

The format of Executable files

• Win32PE (An In-Depth Look into the Win32 Portable Executable File Format)
• Pc Exe Format from The Interrupt List by Ralph Brown
• Ne Format (the NE (New Executable) format (16 bit Windows))
• ExeFmt A description of the New Executable (NE) 16-bit Windows format.
• Pe Dump (PE dump program)
• VXPE (VX Portable Executable Viewer)
• PE Explorer (Commercial tool)
• Manuals on several executable file formats (OMF, PE, ELF, Dwarf, etc)

Tool generator tools

These tools generate tools such as disassemblers, code generators, perhaps even architecture simulators from specification files.

• Njmc Tk The New Jersey Machine-Code Toolkit
• Sim-nML might be considered a competitor to the NJMC toolkit. Using specifications, you can generate disassemblers, code generators, simulators, etc.
• CGen is a framework for developing generators of CPU-related tools such as assemblers, disassemblers and simulators.
• ISDL (Instruction Set Description Language) may also be applicable.
• This page from Obsidian Software has a great list of options and survey papers.

Resource extractors

Resource extractors specialised for Visual Basic, .NET, etc are in other pages.

• Resource-Grabber, a tool that scans and extracts from PE binaries useful resources such as icons, bitmaps, sound files and more.

Fenris tools

Fenris is a multipurpose tracer, GUI debugger, stateful analyzer and partial decompiler intended to simplify bug tracking, security audits, code, algorithm, protocol analysis and computer forensics. One of the tools, dress, can attempt to restore a symbol table in a stripped executable file (adding symbols for statically linked libraries that it recognises). It seems that this tool only supports gcc at present, but the idea is interesting. GPL'd and downloadable from the web page. Linux/x86 only.

Binary file decompilation

• Decompilation of executables (http://www.debugmode.com/dcompile), is a first-timer's tutorial into the process of decompilation and ethics. Also has the code for DisC, a simple decompiler for DOS Turbo C compiler generated executables.

• Learn to Decompile Programs by hand now (a tutorial).

• The Revenge project aims to produce a sort of dynamic decompiler, which records instruction executions, and learns the actual values taken by variables in running the project. As of January 2004, this project is still in the planning stages.

Java and .NET related

See Java Decompilers links or Dot Net Decompilers links.

Delphi related

• DeDe reproduces aspects of a Delphi compiled program. It also has a DCU Dumper to "retrieve near to pascal code of your DCU files".

Conferences and workshops

• The Working Conference on Reverse Engineering (WCRE) has decompilation in its list of relevant topics.

• ACM SIGPLAN Symposium on Partial Evaluation and Program Manipulation - (PEPM). Specifically includes decompilation in its topics of interest.

• The workshop on Source Code Analysis and Modification (SCAM) also lists decompilation in its list of relevant topics.

• The European Conference on Software Maintenance and Reengineering (CSMR) includes topics such as "reverse engineering of embedded systems". Non European contributions are welcome. See CSMR 2005, or http://reengineer.org.

• The International Conference on Software Maintenance (ICSM) publishes some papers related to decompilation.

Decompilation-related Theses

• Reverse Compilation Techniques, C. Cifuentes, Queensland University of Technology PhD thesis, 1994.

• Static Single Assignment for Decompilation, M. Van Emmerik, University of Queensland PhD thesis, 2007. Also available as gzipped postscript.

• WYSINXYX: What You See is Not What You Execute, Gogul Balakrishnan, University of Wisconsin-Maddison PhD thesis, 2007. Uses IDA Pro and custom code to analyse x86 binaries for security problems.

• Designing an Object-Oriented Decompiler, D. Eriksson, Blekinge Institute of Technology Masters thesis, 2002. See also the Desquirr IDA Pro plugin.

• Proving Program Refinements and Transformations, M. Ward, Oxford University PhD thesis, 1989. This is the basis for Ward's future work, which is able to transform assembly language to C on an industrial scale.

Decompilation Papers

• "Type Based Decompilation", Alan Mycroft. Proceedings of ESOP'99, LNCS 1576, Springer-Verlag, 1999.

• "Using a Decompiler for Real World Source Recovery", Mike Van Emmerik and Trent Waddington. In Proceedings of the Working Conference on Reverse Engineering, IEEE-CS Press, 2004. An extended version is available here.

• "An Experimentation Framework for Evaluating Disassembly and Decompilation Tools for C++ and Java", L. Vinciguerra, L. Wills, N. Kejriwal, P. Martino and R. Vinciguerra. In Proceedings of the Working Conference on Reverse Engineering, Nov 2003, IEEE CS-Press, pages 14-23.

Decompilation Books

There are at present no books specifically on the subject of native executable decompilation.

• "Reversing: Secrets of Reverse Engineering" by Eldad Eilam has a chapter on native executable decompilation. Published by Wiley in April 2005. ISBN: 0-7645-7481-7.

• "Security Warrior" by Cyrus Peikari and Anton Chuvakin (O'Reilly 2004) has chapters on reverse engineering of machine code Windows (online chapter), Linux, Windows CE, and more.

• "Exploiting Software : How to Break Code" by Greg Hoglund and Gary McGraw has a short section on disassembling and decompiling. Unfortunately, the authors confuse these two processes, and make statements like "REC provides 100% C source code recovery for some kinds of binary executables" (not true; it produces C-like output). Addison-Wesley 2004, ISBN 0201786958.

• See also Java decompilation books.

Online Collaborative Books

• The collaborative book "Introduction to Reverse Engineering Software", by Mike Perry and Nasko Oskov, which is looking for contributions and a publisher.

• The WikiBooks book on Reverse Engineering.

Miscellaneous

• Hex-rays decompiler plugin. IDA Pro has a commercial decompiler plugin now.

• Hexblog, by Ilfak Guilfanov (author of IDA Pro), has a decompilation category. Other categories, such as the IDA Pro category, are often of interest.

• QuantumG's blog was mostly about decompilation, especially the earlier entries. Some very good information.

• Windows Source Project, maintained by Clive Turvey.

• List of Debuggers and Disassemblers (from http://www.tech-faq.com). Also their "What is a Decompiler?" page.

• Free Disassemblers, Decompilers, Binary / Hex Editors and Viewers (from http://www.thefreecountry.com).

• x86 Assembly Language FAQ

• The Redo Project Archive.

• You can use the dllman32 Windows Dynamic Link Library Investigator for finding dependencies among DLL's.

• The Softpanorama page on Decompilation and Decompilers. Softpanorama describes itself as "resources for the independent study in computer science and programming".

• The Code Breakers Journal.

• Bob Stout posted a short history of PC C compilers.

• http://www.codesites.com (development related links)

• Fravia's page of Reverse engineering has a cracker's viewpoint, including a page on the legality of reverse engineering. The URL keeps changing; just search for it.

• ProgramObfuscation could be considered a defence to decompilation.

• DecompilationUrls (ordered alphabetically by URL).

• The static recompilers Yahoo group have the goal of statically translating binary code (mostly old arcade games) from one architecture to another. There is a tool called Orion that emits a sort of unrolled interpreter of input machine instructions into C code. It's basically static binary translation, so the output is hard to read, and the original machine's instructions are very visible. Works on code from Z80, 6502, and a few other architectures.

• Unconfirmed: John Banning and Hans Pufal's NLZ program, said to be part of Hunter Systems's XDOS suite. It was reportedly able to decompile PC applications and help port them to Unix workstations. Original contact: Hunter Systems, since acquired by Miltiport of Mountain View, CA, USA.

• Search freshmeat for "decompiler" or "decompile".

• Search SourceForge for "decompiler" or "decompile".

• Search Google Scholar (in Beta at the time of writing) for "decompiler" or "decompilation".

• Search CiteSeer.IST for "decompiler" or "decompilation".

• (dmoz.org, the Open Directory).

---

CategoryDecompilation