Log in

View Full Version : IDA introduces full decompilation (to source code, yes)


dELTA
April 10th, 2007, 02:54
Ilfak just announced a new addition to IDA (>= 5.1), which will provide full decompilation to source code. Interesting indeed.

http://hexblog.com/2007/04/decompilation_gets_real.html

LLXX
April 10th, 2007, 03:36
I'll be the first to say this

FUCKIN' AWESOME!

Might finally be worth upgrading

...although I'm still a bit puzzled as to why such a thing wasn't invented sooner; I mean, compilers have been around longer than I am, and I'm sure I wasn't the only one to notice they generated code with predetermined patterns. Or, maybe this is the first public announcement...

edit: I wonder how Delphi or Asm would be decompiled into... C

owl
April 10th, 2007, 13:38
although, that would be great, I kind of wandering how software developers would feel about it. After all, this would make easier for anyone to reverse the executable.

By the way, is this tool will be a pluging on IDA 5.1? or it will be part of IDA 5.1?

_Sigma
April 10th, 2007, 13:56
Oh wow. Does that ever look sexy. I really wish that Ilfak would sell to students...

Ah well. Any rumors on a release date?

fr33ke
April 10th, 2007, 15:11
To call this decompilation would go a bit far... prettified disassembly would be closer to the truth I think. Nothing new, just eyecandy that makes it a bit easier to understand.

In fact Desquirr (http://desquirr.sourceforge.net/) has been around for quite some time.

LLXX
April 10th, 2007, 17:55
I hope I live to see the day when programs can be decompiled into compilable source code sans comments and original variables names, then recompiled into identical binary output using the compiler that produced the original executable. That would be "true" reverse engineering -- decompiling a program, editing the source, then recompiling. Either open-source and non-commercial software will become dominant ("if you don't open the source, anyone can open it for you", or (this would be horrible) new laws would be implemented restricting decompilers.

CluelessNoob
April 10th, 2007, 19:47
.NET is pretty much there, although its not what I would consider "executable" code.

But between ILDASM and ILASM I've manage to "fix" a couple programs that didn't behave nicely.

Aimless
April 10th, 2007, 23:55
Ho-hum! I think its frightfully ordinary. Its mostly pseudocrap and free plugins do an equally better job. Ilfak and Pierre seem to be running out of ideas to market IDA. Case of "fuck! 5.0 got warezed. How do we get them to buy 5.1?" anyways good for trying out on winzip etc...

LLXX
April 11th, 2007, 00:15
Quote:
[Originally Posted by CluelessNoob;64857].NET is pretty much there, although its not what I would consider "executable" code.

But between ILDASM and ILASM I've manage to "fix" a couple programs that didn't behave nicely.
Indeed, and there are true decompilers (e.g. .NET Reflector) which can decompile .NET into C#, J#, or even VB.NET, and the result will compile and behave the same as the original. One of the reasons why I view .NET (and Java) as more of a scripting language/system.

disavowed
April 11th, 2007, 01:57
Quote:
[Originally Posted by Aimless;64859]Ho-hum! I think its frightfully ordinary. Its mostly pseudocrap and free plugins do an equally better job.

Call me crazy, but this is the best decompiler output that I've seen so far, and I've tried Desquirr, Inquisition, Boomerang, and all the others that I've ever known to exist.
Aimless, which plugin(s) are you referring to that do a better job?

0xf001
April 11th, 2007, 06:38
holy shit,

i missed that post nod, nod, its absolutely fucking great
i know a bit about the problematic when building disassemblers / code analysis, and to come to such an output ... just

i agree with aimless, too, it is to be seen how well that will work on "any" binary. for sure the accuracy will vary between targets.
its also a question of usefullness ... i am not usre, but think it can make rce easier to see some stuff in C. i think its at least good to translate blocks of code, not really full executables ...

anyway, i want it! want to play with that ...

cheers, 0xf001

dELTA
May 11th, 2007, 06:43
It is now in private beta phase, and got a name: Hex-Rays

Some, docs and more info here:

http://www.hexblog.com/hexrays/manual/

Looks really promising!