{"id":1088,"date":"2020-03-26T21:32:12","date_gmt":"2020-03-26T20:32:12","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1088"},"modified":"2025-03-20T15:48:24","modified_gmt":"2025-03-20T14:48:24","slug":"decompiler-disassembler","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1088","title":{"rendered":"Decompiler \/ Disassembler"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Check also IDEs like Intel\u00adliJ, Visu\u00adal Stu\u00addio, Eclipse,&nbsp;\u2026<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>gdb<\/li>\n\n\n\n<li>obj\u00addump<\/li>\n\n\n\n<li>Radare 2<\/li>\n\n\n\n<li>ltrace .\/a.out<\/li>\n\n\n\n<li>Gen\u00ader\u00adal\n<ul class=\"wp-block-list\">\n<li><span class=\"caps\">IDA<\/span> (free)<\/li>\n\n\n\n<li><a href=\"https:\/\/ghidra-sre.org\/\">Ghidra<\/a>\n<ul class=\"wp-block-list\">\n<li>Rename func\u00adtions after guessing<\/li>\n\n\n\n<li>Search for inter\u00adest\u00ading strings and go to occur\u00adrences to direct\u00adly go to more inter\u00adest\u00ading code. Don\u2019t review the code from start&nbsp;until.\u2026<\/li>\n\n\n\n<li>Try to guess which struc\u00adtures a vari\u00adable could be and then try to rede\u00adfine a func\u00adtion. For exam\u00adple, if you know that a vari\u00adable seems to be an array, set the vari\u00adable as such. The code gets much more eas\u00adi\u00ader to&nbsp;read.<\/li>\n\n\n\n<li><em>See also slides from the Inci\u00addent Response March 2025 training.<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Java:\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/Konloch\/bytecode-viewer\">GitHub \u2014 Kon\u00adloch\/byte\u00adcode-view\u00ader: A Java 8+ Jar <span class=\"amp\">&amp;<\/span> Android <span class=\"caps\">APK<\/span> Reverse Engi\u00adneer\u00ading Suite (Decom\u00adpil\u00ader, Edi\u00adtor, Debug\u00adger <span class=\"amp\">&amp;<\/span>&nbsp;More)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/java-decompiler.github.io\/\">Java Decom\u00adpil\u00ader<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/fesh0r\/fernflower\">GitHub \u2014 fesh0r\/fernflower: Unof\u00adfi\u00adcial mir\u00adror of Fer\u00adn\u00adFlower Java decom\u00adpil\u00ader (All pulls should be sub\u00admit\u00adted upstream)<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Net\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.red-gate.com\/products\/dotnet-development\/reflector\/\">.<span class=\"caps\">NET<\/span> Reflec\u00adtor<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/dnSpy\/dnSpy\">GitHub \u2014 dnSpy\/dnSpy: .<span class=\"caps\">NET<\/span> debug\u00adger and assem\u00adbly editor<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/icsharpcode\/ILSpy\">GitHub \u2014 icsharpcode\/ILSpy: .<span class=\"caps\">NET<\/span> Decom\u00adpil\u00ader with sup\u00adport for <span class=\"caps\">PDB<\/span> gen\u00ader\u00ada\u00adtion, Ready\u00adToRun, Meta\u00adda\u00adta (<span class=\"amp\">&amp;<\/span>more) \u2014 cross-platform!<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.jetbrains.com\/decompiler\/\">dot\u00adPeek: Free .<span class=\"caps\">NET<\/span> Decom\u00adpil\u00ader <span class=\"amp\">&amp;<\/span> Assem\u00adbly Brows\u00ader by JetBrains<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Python (yes, you can cre\u00adate exe files from Python byte\u00adcode .pyc&nbsp;files\u2026)&nbsp;<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pypi.org\/project\/uncompyle6\/\">uncompyle6 \u00b7&nbsp;PyPI<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/sourceforge.net\/projects\/easypythondecompiler\/\">Easy Python Decom\u00adpil\u00ader down\u00adload | SourceForge.net<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/extremecoders-re\/pyinstxtractor\">GitHub \u2014 extreme\u00adcoders-re\/pyin\u00adstx\u00adtrac\u00adtor: PyIn\u00adstaller Extractor<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Check also IDEs like Intel\u00adliJ, Visu\u00adal Stu\u00addio, Eclipse,&nbsp;\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468,355],"tags":[236,237],"class_list":["post-1088","post","type-post","status-publish","format-standard","hentry","category-general","category-reverse-engineering","tag-decompiler","tag-disassembler"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1088"}],"version-history":[{"count":13,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1088\/revisions"}],"predecessor-version":[{"id":4795,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1088\/revisions\/4795"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}