#Decompiler

1 messages · Page 1 of 1 (latest)

iron lagoon
#

My decompiler reached a milestone - I can now lift every instruction in this sample function I've been using, which includes rep.movsd instructions.... though no floating point yet. The rest has been a lot of "internal" updates for how I handle going from basic blocks to abstract syntax trees. Hopefully this will speed up the process later.

I've also added basic symbol resolving logic that tracks scope of the high-level variables.... Of course nothing is creating them yet so that's why you see a lot of the "unresolved" symbols.

The rest of updates include some quality of life updates like being able to click on keywords, assignment operators, and function calls and that will take the assembly view to the instruction responsible for that operation. I've also added the little block offset drop down lines, which was easy to implement but surprisingly useful.

It's also open source on github

image.png
GitHub
GitHub - Hexorg/Ouroboros: Decompiler written in Rust

Decompiler written in Rust. Contribute to Hexorg/Ouroboros development by creating an account on GitHub.

iron lagoon
#

@pliant ivy I got my output structure to match Ghidra!

image.png
pliant ivy
#

nice, awesome!

iron lagoon
#

New screenshot

screenshot.png
latent wren
#

very cool :)

iron lagoon
#

@brazen iron Were you ever able to finish bypassing obfuscation in this video? https://www.youtube.com/watch?v=PKlOCMjaGdc
I suspect this symbolic execution engine might be able to do a better job there.

YouTube
Nathan Baggs
This Game Was Dead Forever - Then I Hacked It

Fixing an old point and click adventure game (Discworld Noir) to work on Windows 11

Join us on Discord: https://discord.gg/9FkkMgXSUV

Become a member to get early access to videos - https://www.youtube.com/channel/UCQvW_89l7f-hCMP1pzGm4xw/join

Tools:
🐉 - Ghidra - https://github.com/NationalSecurityAgency/ghidra
🐛 - x64dbg - https://gith...

▶ Play video
brazen iron
#

I didn't end up doing any more afterthe video was done

iron lagoon
#

oh it's not even on gog

brazen iron
#

Yeah it was one from abandonware site

#

I’ve spoken to someone at GoG about this, apparently the question of who owns the IP is complex

#

I’m not even joking, the IP might be owned by the King of England

brazen iron
#

Your project is really cool by the way 🙂

iron lagoon
#

Thanks! I’m curious to try it on some obfuscation when I get it working enough

iron lagoon
#

Good news! Ouroboros now takes pcode as an input. That means it can decompile any CPU machine code that ghidra can

pliant ivy
#

adding ACPI AML might be nice too

iron lagoon
#

That’ll be for if it ever gets off of a workbench

iron lagoon
#

New update: file loading support!

image.png
fresh granite
#

A coworker shared this with me, awesome work.

iron lagoon
#

I’m hoping to get it to actually useful state 😅

fresh granite
#

I had some free time to tinker with this, and I am currently trying to implement sign extend.

iron lagoon
#

I may be missing an edge case though

floral relic
#

This project is great, BTW I have experience with Ghidra Sleigh and Rust, if you need help with PCode or similar, let me know.

iron lagoon
iron lagoon
floral relic
#

I tried to implement a few PCode instructions but I could no figure out how to handle the Flat Expression Tree API.

#

Next time I'll try to fix the ARM Thumb instruction address fetching problem.

prime nymph
#

@iron lagoon is this project still going?

#

it looks like a very cool project

iron lagoon
prime nymph
iron lagoon
#

There’s was a small pull request but nothing major

prime nymph
#

I've used Ghidra for a long time and its limitations drive me up the wall, so if there's a way I can help out with a project that ends up better than it I'd love that

iron lagoon
#

The problem isn’t really expertise - it’s breadth. There’s just a lot of formats to support and assumptions to break.

#

You’re welcome to try though

prime nymph
#

wydm by formats? are you talking SLEIGH related stuff or just binaries?