Question for the experts: Good C De-Compiler

[darmstadt]

And if you're thinking of looking at propriety code, don't

[Doggy Styles]

Afternoon Experts,

I need to look at some compiled c code.

Can anyone recommend a good C De-Compiler ?

Ta,

Milan.

PM threaded. He'll knock one up for you tomorrow lunchtime.

[OwlHoot]

Looks like Milan's been bungey posting again, judging by his conspicuous absence.

He's probably forgotten all about this thread by now.

[MarillionFan]

You can disassemble object code to assembly fairly easily but getting back to C is approximate at best.

There are so called decompilers out there but bit of a waste of time IMO. You also need to specify platform...

It'll be for an HP Printer.

[AtW]

IDA is best.

[rootsnall]

Afternoon Experts,

I need to look at some compiled c code.

Can anyone recommend a good C De-Compiler ?

Ta,

Milan.

What you doing messing with that tulip

You want to get into .Net

[OwlHoot]

Afternoon Experts,

I need to look at some compiled c code.

Can anyone recommend a good C De-Compiler ?

Ta,

Milan.

For what architecture? Intel? ARM? Motorola?

Also, is the compiled code in intermediate binary files, which can easily be parsed as these files have a documented structure with short parcels of data and code etc, or is it an executable file?

In the latter case, does the program use dynamic/shared linked libraries, or is the relevant library code embedded statically in the EXE file itself?

An EXE program with embedded library code is next to impossible to decompile, because the actual code is a small proportion of the whole, and very hard to distinguish from the library code, unless the file also includes symbol tables.

IDA (formerly called IDA Pro) is the most well known, and I think that can recognise code from many standard embedded libraries

Also, do you really mean C, or is it C++? A disassembly of the latter will be _much_ harder to follow, due to all the crud and bells and whistles automatically associated with the code.

In general, disassembly of an executable program of any significant length, without a symbol table or patterns of disassembled earlier similar versions available, is _very_ hard, painstaking, and time-consuming work, and often well-nigh impossible!

edit: If you have a serious requirement for this, for example if some baboon has lost vital source code which you have to reconstruct, I have a fair bit of experience and might be available for some freelance work in the evening if you'd like to PM me with details. (I once wrote my own Intel disassembler, so I know the Intel instruction set backwards) But I'm not promising anything!

[doodab]

If you're on solaris you can use dtrace to trace execution, function entry and exit and so on.

If the executable has debug info in you can attach a debugger (you can do it without debug info but it's not as useful)

Strings will dump the string table.

Both of those will give you some insight into what it does.

[cojak]

Someone walked off with the source code? Or was it 'archived'?

[doodab]

You can disassemble object code to assembly fairly easily but getting back to C is approximate at best.

There are so called decompilers out there but bit of a waste of time IMO. You also need to specify platform...

[milanbenes]

Afternoon Experts,

I need to look at some compiled c code.

Can anyone recommend a good C De-Compiler ?

Ta,

Milan.