#decompiler

Decompile to C 的工具

昨天在 Hacker News 上看到「Decompiler Explorer (dogbolt.org)」這篇，裡面列出了很多 Decompile to C 的工具 (就不用直接硬看 assembly)，包括了 open source 與商用軟體： angr (BSD-2-Clause)。 Binary Ninja (商業軟體) Boomerang (BSD-3-Clause) Ghidra (NSA，Apache-2.0) Hex-Rays (商業軟體) Rec Studio (商業軟體) Reko (GPL-2.0) RetDec (Avast，MIT) SmartDec (GPL-3.0) 網站本身則是提供界面可以交叉比較，不過各家的結果看起來還是有侷限…

I haven't looked in to it in decades. I remember there being one, and Clickteam apparently wasn't happy with it, so it was the kind of thing that got passed around in secret, and there were rumors it even contained a virus. It wouldn't surprise me if that last part was a rumor started by Clickteam.

That being said, this was back in the Click & Create days, so we're talking 1999/2000/2001. I doubt a decompiler like that would work on MMF 1.5.

Obviously though, something like Chowdren probably counts as a decompiler. There used to be a public version of that, but it seems like its been locked down after the developer started selling his C++ porting services.

amzn_assoc_ad_type = "banner"; amzn_assoc_marketplace = "amazon"; amzn_assoc_region = "US"; amzn_assoc_placement = "assoc_banner_placement_default"; amzn_assoc_campaigns = "amzn_vicc_cloudcam_1017"; amzn_assoc_banner_type = "category"; amzn_assoc_isresponsive = "true"; amzn_assoc_banner_id = "1J0CHGJT75D586M66602"; amzn_assoc_tracking_id = "kraljevicn1-20"; amzn_assoc_linkid = "c122cc4768b349b4aab7d3099b74ea1c";

Sunday Round up for this week!

Articles:

Ghidra Decompiler Internal Docs

Top Cyber Security Trends for the Year Ahead

Teaching machines to triage Firefox bugs – Mozilla Hacks : the Web developer blog

Best IP Address Management Tools for Linux

One of my uglier scripty bits

If you found some other interesting stuff this week feel free to leave a link to it in the comments section. Otherwise feel free to check out the last roundup here.

ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA

Original text by CYBEREASON NOCTURNUS RESEARCH

RESEARCH BY: ELI SALEM

In 2018, we saw a dramatic increase in cyber crimes in Brazil and, separately, the abuse of legitimate native Windows OS processes for malicious intent. Cyber attackers used living off the land binaries (LOLbins) to hide their malicious activity and operate stealthily in target systems. Using native, legitimate operating…

IDA 居然也提供免費版了，雖然是比較舊的版本，而且不提供技術支援：「IDA Support: Freeware Version」。IDA 是個可以反組譯以及當 debugger 的工具： IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger that offers so many features it is hard to describe them all. Just grab an evaluation version if you want a test drive. 我猜是 Avast 放出 MIT 授權版本的 RetDec 的關係 (參考「Avast 放出他們的 Decompiler，RetDec」這篇)，導致 IDA 這邊要做一些動作推廣試用……

RetDec - Retargetable Machine-Code Decompiler #decompiler #Machine-Code #RetDec #Code #hacking

RetDec is a retargetable machine-code decompiler based on LLVM. The decompiler is not limited to any particular target architecture, operating system, or executable file format:

Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code.

Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC.

  Features:

Static analysis of executable files…

Source: Merry Xmas,Code Nerds: Avast Open-Sources Decompiler The post Merry Xmas,Code Nerds: Avast Open-Sources Decompiler appeared first on MondoUnix.