• Welcome to Valhalla Legends Archive.
 

Another good idea for a project..

Started by iago, December 30, 2002, 11:21 PM

Previous topic - Next topic

iago

This is just an idea to throw out, since I have very little free time and am already tied up in my own projects, but eh?

Writing a good decompiler.  Basically, take a disassembler to the next level; have it convert code right back to C or C++, including known header functions it finds, various function conventions (__cdecl, __fastcall, etc).

This would probably be very difficult, but eh?

That's all for now.. it's about 6 hours past my bed time :)
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Yoni

#1
Tell me when you've made it better than IDA :)

iago

#2
I'll get right on it :-P

It's on the bottom of my real life priority queue right now, and the queue is big and my speed is slow, so it could take awhile :)
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Banana fanna fo fanna

#3
It'd require figuring out how vc++ expands ifs and classes. You'd probably need to write a debugger too, to runtime check the types of variables PUSHed on the stack as function args.

Eibro

#4
Good luck once you get into virtual functions/dynamic binding/inheritance/templates/polymorphism or even classes for that matter... one word: Impossible.

You might be able to get some level of conversion to C, but you'll never be able to convert it back to it's C++ equivalent. (Assuming it was written in C++)
Eibro of Yeti Lovers.

Adron

#5
Also note that optimization modifies all the original structures generated very much - interleaving instructions from different source code lines, removing/joining redundant instructions etc.

Skywing

#6
Not to mention how much things can change depending on the compiler used (ebx used as this sometimes in VC7, for example).

Grok

#7
And, and, and ... good luck when ... you know ... good luck.

iago

#8
If it was easy, there would already be one floating around, but I've never heard of one so it must be fairly difficult :-D
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*