Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Perfect decompilation definitely has its advantages, but that's something I simply don't have it in me to pull off. Tracking down derelict toolchains and SDKs, endlessly tweaking compiler options and source code to get that thousand instruction long function to match perfectly is not for everybody.

The trouble with decompilation projects is that there's hardly any tooling or literature available on the topic [1], so people usually end up developing custom tooling and methodology on their own to solve their issues. For example, personally I went down the path of delinking programs back into object files in my own project. While I find it quite nifty, it also isolates me on my own desert island and I know of other decompilation projects with totally different approaches in a similar situation.

Decompilation projects can be quite intellectually rewarding, but they are essentially R&D projects in a barely explored field. Wander off the thin strip of beaten path and you're basically on your own in an endless primordial jungle.

[1] At least until decomp.me came along, but that's geared for perfect decompilation only. Any other approach and you're still on your own.



>For example, personally I went down the path of delinking programs back into object files in my own project.

Wow, that's exactly the approach I wanted to take. However, as you've said, there's basically no tools for this, so it's a bit demoralizing.


> However, as you've said, there's basically no tools for this, so it's a bit demoralizing.

I wrote a Ghidra extension to do that, you can check it out there: https://github.com/boricj/ghidra-delinker-extension


Nice! I'm mainly touching Win32 stuff so I suppose it would need quite a lot of adapting (and a COFF implementation) but this is very intriguing, I'll need to dive into this.


Depending on what you want to do, most of the pieces might already be there.

I've designed my Ghidra extension so that the object file exporters are decoupled from the relocation analyzers through a generic relocation data model. I've already implemented a relocation synthesizer for 32-bit x86, so writing a COFF object file format exporter should be a fairly self-contained project that doesn't impact the rest of the extension.

A while ago somebody stumbled upon my stuff and asked some questions related to delinking C++ code on Windows, you might find some answers there: https://github.com/boricj/ghidra-delinker-extension/issues/4

Don't hesitate to contact me directly if you want to discuss this stuff more in-depth.


Thanks for extending the offer! I am a bit busy but I really appreciate all of the information. I've got plenty of new things to dig into now, I'll have to seriously set aside some time to take another look, this could seriously help me with some of my reversing projects. I'm willing to put in tons of manual effort to bridge the gap, and it feels like if I could leverage this it could act as quite a force multiplier.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: