Decompilers that converts a program back to it's original source?

[henry2221]

Earlier this week I had a talk with someone who told me that they've seen a decompiler which is able to convert a program back to it's original source in a language such as C++. From my knowledge I believe this is impossible, but I was wondering if anyone else knows anything about this?

 

[mgb_phys]

You can't generally convert back to the 'original' source. You can decompile back to source code but it isn't necessarily the same source that you wrote.
Since the compiler (especially a modern optomising compiler for C++) can produce the same output for the different input there isn't a one-one mapping between what you wrote and what the compiler generates.

For languages that compile to a runtime environment like C# and Java it is possible to decompile them back to the original code (or very close to) - there are products called obsfurcators which will rewrite the soruce code to make it confusing but still do the same thing. This helps make it more difficult to decompile.

 

[robphy]

http://www.google.com/search?q=decompiler

 

[-Job-]

Like mgb_phys mentioned, VB6, Java and C# programs are easily decompiled. For C# there's Spices.Net, and Salamander even has a web-based decompiler, they're both pretty good, but for example they don't handle switch statements very well - they tend to generate a mix of goto and if/else which is less readable. From the point of view of the decompiler there's some ambiguity as to what the original source of the code was, which varies from languages that run on a VM, or are interpreted to languages that compile to machine code.

Decompiling a C/C++ program is much harder. In Java you can interpret the Virtual Machine byte code, and in C# or any .NET language you can interpret the IL (intermediate language) that the compiler generates. For example, you can use ildasm.exe (which comes with visual studio) to browse any .NET assembly and actually look at the IL - you can see in ildasm just how much data a decompiler has available (the IL is not very far away from the original source). In C/C++ the compiled code has much less information regarding the original source, so it's much more ambiguous. You're able to get the Assembly level code using programs like ADA or OLLY, but to get any further than that you'll need to be a pro, or have some knowledge of the original code.

For VB6 I've use VB Decompiler with good results.

 

[Tony11235]

Uhh, if that was the case, it would be a dream for the open source world.

 

[torelativity]

I have tried a few decompilers but haven't been successful with any of them... Few of them never work at all (eg:- boomerang never worked for me till date), few that work for a few attempts and stop (REC Studio)... However, you will not be able to get the exact (or even similar) decompiled code as the original source because we use high level languages.
However there are decent disassemblers available that convert the object code into assembly code (Olly debugger is a very good one). However, analyzing large programs is really difficult in assembly code because there are too many things to be considered at a time...
This has been written with regard to C...

 

[Dendi]

"IDA Pro" is worth a try...u can search for IDA Pro script to "translate" assembly code to native C code...

 

[zyh]

Like mgb_phys mentioned, VB6, Java and C# programs are easily decompiled. For C# there's Spices.Net, and Salamander even has a web-based decompiler, they're both pretty good, but for example they don't handle switch statements very well - they tend to generate a mix of goto and if/else which is less readable. From the point of view of the decompiler there's some ambiguity as to what the original source of the code was, which varies from languages that run on a VM, or are interpreted to languages that compile to machine code.

Decompiling a C/C++ program is much harder. In Java you can interpret the Virtual Machine byte code, and in C# or any .NET language you can interpret the IL (intermediate language) that the compiler generates. For example, you can use ildasm.exe (which comes with visual studio) to browse any .NET assembly and actually look at the IL - you can see in ildasm just how much data a decompiler has available (the IL is not very far away from the original source). In C/C++ the compiled code has much less information regarding the original source, so it's much more ambiguous. You're able to get the Assembly level code using programs like ADA or OLLY, but to get any further than that you'll need to be a pro, or have some knowledge of the original code.

For VB6 I've use VB Decompiler with good results.

I'm quite agree with you. Throuth I do some coding on ASM, It still difficult to read my disasmbled code in OLLYDBG, sometimes I't hard to read the source code if you don't understand the true workflow and the logic.

 

[jim mcnamara]

VB6 decompilation raises a point. MS changed the generation of dynamic libraries from VB5 to VB6 so that when developers supplied .vbx or .dll or other libraries to users, the users could not decompile the code into readable VB code and steal intellectual property. This is still true in .NET, I believe.

So, this means that only executable image files can be decompiled with any real success in Windows.

 

[KingMike]

Earlier this week I had a talk with someone who told me that they've seen a decompiler which is able to convert a program back to it's original source in a language such as C++. From my knowledge I believe this is impossible, but I was wondering if anyone else knows anything about this?

I don't know of anything like that. However, for windows I use PE Exp from http://www.heaventools.com/

On linux just disassemble.

This won't get you to C++ but it will give you code.

 

[-Job-]

I use PE Explorer as well, i recommend it.

 

[noob2]

Yes, I second PE Explorer. The best thing about PE Explorer is that it is really easy to use compared with other disassemblers.