64810

Possible to decompile DLL written in C?

Question:

I want to decompile a DLL that I believe was written in C. How can I do this?

Answer1:

<strong>Short answer:</strong> you can't.

<strong>Long answer:</strong> The compilation process for C/C++ is very lossy. The compiler makes a whole lot of high and low level optimizations to your code, and the resulting assembly code more often than not resembles nothing of your original code. Furthermore there are different compilers in the market (and each has several different active versions), which each generate the output a little differently. Without knowledge of which compiler was used the task of decompiling becomes even more hopeless. At the best I've heard of some tools that can give you some partial decompilation, with bits of C code recognized here and there, but you're still going to have to read through a lot of assembly code to make sense of it.

That's by the way one of the reasons why copy protections on software are difficult to crack and require special assembly skills.

Answer2:

It is possible, but extremely difficult and will take ginormous amount of time even if you're pretty well versed in C, assembly and the intricacies of the operating system where this code is supposed to work.

The problem is, optimization makes compiled code hardly recognizable/understandable for humans.

Further, there will be ambiguities if the disassembler loses information (e.g. the same instruction can be encoded in different ways and if the rest of the code depends on a particular encoding which many disassemblers (or their users) fail to take into account, the resultant disassembly becomes incomplete or incorrect).

Self-modifying code complicates the matters as well.

See in <a href="https://stackoverflow.com/q/273145/968261" rel="nofollow">this question</a> more on the topic and available tools.

Answer3:

You can, but only up to a certain extent:

<ol><li>Optimizations could change the code</li> <li>Symbols might have been stripped (DLL allows to refer to functions residing inside via index instead of symbol)</li> <li>Some instruction combinations might not be convertible to C</li> <li>and some other things I might forget...</li> </ol>

Recommend

  • Obfuscated code contains same member variable names
  • Lambda expressions and MethodInfo
  • connecting to a grails app database
  • Generate token for access server resources
  • Where does Xcode store .m files of a framework?
  • Why does C3p0's ComboPooledDataSource successfully connect to a database, but its clone doesn&#
  • Using Google Api: Speech To Text on PC Version
  • Set User Control's default event
  • jQuery ajax security
  • Tracking screen recorder in windows app
  • wxPython: binding wx.EVT_CHAR_HOOK disables TextCtrl backspace
  • Unable to use dot layout (graphviz as a library)
  • Exposing an enum in a QML signal
  • Insert Statement
  • Azure table query partial partitionkey guid match
  • PHP multiple file uploads
  • Javascript/Jquery runs fast in desktop browsers, but slow in mobile/smartphone browsers…should I spl
  • DIV instruction jumping to random location?
  • Android Studio 1.3 RC3. Google Play services out of date. Requires 7571000 but found 6774470
  • Implementing “partial void” in VB
  • C# program and C++ DLL compiled for 32-bit system crash on 64-bit system
  • converting text file into xml using php?
  • Z3: Convert between FP and BitVector?
  • How Lists (specifically, RecyclerView with CardViews) in Android work
  • Unable to get column index with table.getColumn method using custom table Model
  • How to add git credentials to the build so it would be able to be used within a shell code?
  • custom UITableViewCell with image for highlighting
  • Android - Material Design - NavigationView - How to put vertical scroll?
  • Linq Objects Group By & Sum
  • Why is an OPTIONS request sent to the server?
  • Optimizing database types to compact database (SQLite)
  • Statically linking a C++ library to a C# process using CLI or any other way
  • VB.net deserialize, JSON Conversion from type 'Dictionary(Of String,Object)' to type '
  • InvalidAuthenticityToken between subdomains when logging in with Rails app
  • Buffer size for converting unsigned long to string
  • SQL merge duplicate rows and join values that are different
  • How does Linux kernel interrupt the application?
  • LevelDB C iterator
  • Can't mass-assign protected attributes when import data from csv file
  • reshape alternating columns in less time and using less memory