Decompiler Installshield Software

  четверг 23 апреля
      89
Decompiler Installshield Software Average ratng: 4,5/5 3550 reviews

Skip to: Download/Screenshots Installation and Usage Technical Details Supported Formats Credits

Introduction

Thank you for using our software portal. Use the link below and download InstallShield legally from the developer's site. We wish to warn you that since InstallShield files are downloaded from an external source, FDM Lib bears no responsibility for the safety of such downloads. We recommend checking your downloads with an antivirus.

Universal Extractor Feedback
If you have any questions about, or find any problems with, Universal Extractor, please post your comments to the UniExtract subforum on the MSFN message board. This has become the main point of discussion for this project.

Universal Extractor is a program designed to decompress and extract files from any type of archive or installer, such as ZIP or RAR files, self-extracting EXE files, application installers, etc. The full list of supported formats can be found in the table below. It's able to support so many varied file formats by utilizing the many backend utilities listed in the credits at the bottom of the page.

Please note that Universal Extractor is not intended to be a general purpose archiving program. It cannot (and never will) create archives, and therefore cannot fully replace archivers such as 7-Zip or WinRAR. What it will do, however, is allow you to extract files from virtually any type of archive, regardless of source, file format, compression method, etc.

The original motivation behind this project was to create an easy, convenient way to extract files from various types of installation packages without the need to remember arcane command line switches or track down separate utilities to handle the unpacking. Over time, and with the encouragement of its many users and the fine folks over on the MSFN forum, it has evolved into a mature and very capable unarchiving utility that many, including myself, find indispensable.

Screenshots


Universal Extractor context menu
Universal Extractor file/destination GUI
Universal Extractor preferences

Download Current Version: 1.6.1, Released: 05/12/2010

UniExtract Installer (5.3 MB) - This is the recommended download. The installer will automatically install the application and optionally integrate with the Windows Explorer context menu. This package does not contain source code.

UniExtract Binary Archive (4.95 MB) - This archive contains the binaries. Download this if you want a portable version, or just prefer not to use the installer.

UniExtract Source Code (163.13 KB) - This archive only contains the source code, but it includes all support files as well (compiler scripts, installer, etc.). This is best to download (along with the binary archive) if you want to help further development of UniExtract.

ChangeLog, ToDo - UniExtract development details

Universal Extractor Download Archive - archived versions of all official binary and source code releases

Note: If you download Universal Extractor from one of the official links above, it is not infected with a virus. If your anti-virus software tells you otherwise, please see this forum post for details.

Language Files

As of version 1.4, Universal Extractor supports internationalization. If you're interested in translating Universal Extractor into another language, please download the source archive and follow the instructions in English.ini. Please send me your completed translation and I'll include it in the next version of Universal Extractor. Thanks to all of the contributors!

To use these language files, simply download and copy into the lang directory of your Universal Extractor installation. The new language will appear as an option the next time you run UniExtract.

Note: The (alt) language files are alternate translations that are not included with the official release. Sometimes I get multiple submissions for a single language, and I like to give everyone credit, but I generally stick with the first one that's submitted out of fairness. Some of the alternate translations may be better than the included ones (or, they may not be), so feel free to give them a try. If you find that an alternate version is better than the included version, please let me know; I may switch them out for the next release.

Language FileNative NameContributerAdded/Updated
Arabic*العربيةAwadh A Al-Ghaamdi10/22/2008
Arabic (alt)العربيةMusab (KooTaa)10/12/2008
Armenian*Հայերէն HayerenHrant Ohanyan05/11/2010
Bulgarian*БългарскиКирил Кирилов (DumpeR)10/12/2008
Chinese (Simplified)简体中文phCole05/13/2010
Chinese (Traditional)*繁体中文Huang Junwei11/21/2006
Croatian*HrvatskiTomislav Glušac10/22/2008
Croatian (alt1)HrvatskiDanijel Ivanieviæ05/11/2010
Croatian (alt2)HrvatskiIvica Hrvoj Ivanić10/12/2008
Czech*ČeštinaLubomír Hajda05/11/2010
Dutch*NederlandsRobby Kooken10/12/2008
English*English (American)Default/native language file05/12/2010
Finnish*SuomiTeijo Sakkara10/25/2008
French*Françaisjacklours10/22/2008
GermanDeutschArno Krumpholz05/13/2010
Greek*ΕλληνικάNick Mattheakis10/22/2008
Hungarian*MagyarSimon László03/25/2007
Italian*ItalianoTJL73 / Roberto Boriotti05/11/2010
Japanese*日本語Yachuko Nakai11/28/2006
Japanese (alt)日本語Nardog11/28/2006
Korean*한국어/조선말Sunsuk Kim03/21/2007
Persian (Farsi)*فارسیSajjad Mohammadi05/11/2010
Polish*Język PolskiULTIMA PRIME02/22/2007
Portuguese*PortuguêsJosé Gonçalves03/01/2007
Portuguese (Brazilian)*PortuguêsZimzuM / Marcio Barbosa03/21/2007
Romanian*Limba RomânăCristian Stefan02/27/2007
Russian*Русский языкgora05/11/2010
Russian (alt)Русский языкAVV_UA10/12/2008
Russian (old)Русский языкPolarbond02/22/2007
Serbian*SrpskiIvan Stambolić05/11/2010
Slovak*SlovenčinaPeter Žilák02/22/2007
Spanish*EspañolMario Ángel / Leonardo Mauro02/22/2007
Spanish (alt)EspañolArturo Vergara05/13/2010
Swedish*SvenskaStefan Weber05/11/2010
Taiwanese*臺灣話YoYo10/12/2008
Thai*ภาษาไทยPruthisith (Terry) Prateepavanich11/28/2006
Turkish*TürkçeOnur AYDIN03/01/2007
Ukrainian*украї́нська мо́ва,Warrior10/28/2008
Valencian (Catalan)*Valencià (Català)Rafel Hidalgo i Rangel03/25/2007
Vietnamese*Tiếng ViệtNguyen Nhat Quang02/22/2007

* = Included in current release

Installation and Usage

To install UniExtract, download the installer and run it on your system. You will have a few options during installation:

Select Components - These options specify which program components are installed to disk. These options are only really useful if you need to reduce the installation size.

  • Documentation and licensing information - This includes all files in the docssubdirectory
  • Language files for internationalization support - This includes all files in the lang subdirectory
  • Support for ACE files - Binaries and/or libraries required for ACE archives
  • Support for KGB files - Binaries and/or libraries required for KGB archives
  • Support for Pea files - Binaries and/or libraries required for Pea archives
  • Support for StuffIt files - Binaries and/or libraries required for StuffIt (.sit) archives

Set Program Options - These options adjust the default Universal Extractor behavior. They can be changed after installation through the Preferences menu.

  • Default Language - specifies the language used by UniExtract
  • Debug File Location - specifies the directory to which UniExtract should write its debug file
  • Append missing file extensions - attempt to determine and append the correct extension for improperly named files using TrID
  • Maintain archive history - maintain a list of the ten most recent files that were extracted, as well as the destination directories
  • Remove duplicate files - attempt to detect and remove duplicate that may have been created during extraction
  • Remove temporary files - automatically remove temporary files that may be created during extraction
  • Warn before executing files - some .exe archives must actually be executed in order to perform the extraction. Since this can be a security risk (executing unknown/untrusted code is always a bad idea), UniExtract will display a warning before extracting these types of files.

Select Additional Tasks - These options specify additional actions that can be performed by the installer. They only affects installation of Universal Extractor, and cannot be modified later.

  • Enable Explorer context menu integration - allows you to right click on any archive and directly extract its files
    • Add UniExtract Files.. to context menu - adds ability to specify destination directory
    • Add UniExtract Here to context menu - adds ability to quickly extract to current directory
    • Add UniExtract to Subdir to context menu - adds ability to quickly extract to subdirectory
    • Force association with with all supported archive formats - Forces UniExtract to associate itself with all supported file extensions; by default, it will only associate itself with native Windows formats (.exe, .msi, etc.) and other formats not currently associated with another program
  • Add Universal Extractor to your system path - allows you to run UniExtract (and any related binaries) from the command line
  • Create a SendTo icon - add a shortcut for Universal Extractor to your SendTo context menu
  • Create a desktop icon - add a shortcut for Universal Extractor to your desktop
  • Create a Quick Launch icon - add a shortcut for Universal Extractor to your Quick Launch bar

If you wish to automate installation (for custom or unattended installs), please run uniextractXX.exe /? to get a detailed description of available command-line options for the installer. All standard Inno Setup command line parameters apply, but also pay special attention to the Components, Tasks, and Custom Parameters detailed at the bottom of the help window.

For manual installation with the binary archive, simply extract the files to the destination folder you would like. By default, this puts UniExtract in 'portable mode'. This means that the globalprefs option is enabled (see changelog for details) and the history option is disabled (see Program Options above). The end result is UniExtract can be easily run from portable devices like USB flash drives without leaving any trace of use. Of course, it'll also work just as well if copied to a real hard drive, and all preferences can be modified at any time by editing UniExtract.ini, or by running UniExtract.exe /prefs.

Once UniExtract is installed, usage is simple. The easiest way, if you used the installer and enabled context menu integration, is to right-click on any archive and select click one of the UniExtract options. UniExtract Here will extract files to the current directory, UniExtract to Subdir will extract files to a subdirectory named after the file, and UniExtract Files will prompt you for the destination directory.

If you did not enable context menu integration, you may run the Universal Extractor start menu shortcut, or double-click directly on UniExtract.exe. This will launch the UniExtract GUI. Enter (or use the file browser to select) the file you wish to extract and the destination directory, then click OK. It is also possible to drag-and-drop the file you wish to extract onto the icon or main application window to easily extract the dropped file.

UniExtract can also be run from the command line. Run UniExtract.exe /? for detailed command line parameters.

You can use Add/Remove Programs to uninstall UniExtract, or just delete the directory if you used the binary archive.

Technical Details

When a file is passed to UniExtract, it begins by scanning the file with TrID. If the file format matches one of the supported non-executable formats listed below, it immediately begins extraction from the archive. If it's an executable file, it calls PEiD to analyze the file signature. If the signature indicates that it's a supported format, then it attempts to begin extraction. If it is not a recognized signature, it will try running it through 7-Zip and UnZip as default cases. If 7-Zip or UnZip recognizes it, it will be extracted; otherwise, UniExtract displays an error message and exits.

Note: Filetype scanning with TrID is new as of v1.5. Older versions relied on the file extension to identify the filetype. This behavior is still used if the TrID scan cannot determine the filetype.

If the filetype is supported, UniExtract begins by checking for a valid destination directory and recording the directory size. If necessary, a new directory will be created (with a directory size of zero). UniExtract then spawns a shell and calls the supporting binary to begin extracting files from the selected archive to the destination directory. After completion, UniExtract checks the size and timestamp of the subdirectory to determine if extraction was successful; if the size or timestamp is greater than the initial values, UniExtract assumes success and exits. If extraction fails, UniExtract notifies the user and leaves a log file (uniextract.log) that (should) contain any error messages.

The uniextract.log file is created during the extraction process by the tee program. Essentially, all output from the running binary is redirected to tee, which in turn writes the output to the log file as well as echo it to the screen to give the user current progress. Upon successful execution this file is deleted, but if an error is detected it is left alone for the user to review. Note: As of v1.4, the location of uniextract.log can be changed to any user-specified directory.

Supported Formats

As of v1.5, UniExtract uses TrID to determine the filetype of any given file. If this detection fails, file extensions are used as a backup identifier. The table below is a reference of known-supported filetypes and common extensions; any supported archive types should work regardless of actual extension.

Archive TypeCommon File Extension(s)
7-zip archive.7z, .exe
ACE archive.ace, .exe
ARC archive.arc
ARJ archive.arj, .exe
ASpack compressed file.exe
BIN/CUE CD-ROM image.bin, .cue
bzip2 archive.bz2, .tbz2, .tar.bz2
CPIO compressed file.cpio
Debian package.deb
DiscJuggler CD-ROM image.cdi
Encoded files.b64, .uu, .uue, .xx,
.xxe, .yenc, .ntx
Gentee package.exe
gzip archive.gz, .tgz, .tar.gz
IMG floppy disk image.img
Inno Setup package.exe
Installer VISE package.exe
InstallShield Cabinet archive.cab, .1, .lib
InstallShield package.exe
ISO 9660 CD-ROM image.iso
KGB archive.kgb, kge, .exe
LZH compressed file.lzh, .lha
LZMA compressed file.lzma
LZO compressed file.lzo
LZW compressed file.Z, .tz, .tar.Z
LZX compressed file.lzx
MHTML file.mht
Microsoft Cabinet archive.cab, .exe, .imf
Microsoft Compiled Help file.chm
Microsoft compressed file.??_
Microsoft LIT e-book.lit
Microsoft Windows Help file.hlp
HTC NBH ROM image.nbh
Nero CD-ROM images.nrg
NSIS package.exe
Oasis Document Format (ODF) document.odt, .odp, .odg, .ods
Office Open XML (OOXML) document.docx, .pptx, .xlsx
Outlook Express mail archive.dbx
PEA archive.pea
RAR archive.rar, .001, .exe
Reflexive Arcade package.exe
RoboForm package.exe
RPM package.rpm
SetupFactory package.exe
SIS (SymbianOS) packages.sis
StuffIt packages.sit
TAR archive.tar, .tbz2, .tgz, .txz, .tz,
.tar.bz2, .tar.gz, .tar.xz, .tar.Z
UHARC archive.uha
UPX compressed file.exe, .dll
Windows Imaging Format image.wim
Windows Installer merge module.msm
Windows Installer package.msi
Windows Installer patch.msp
Windows Update Standalone patch.msu
Wise Installer package.exe
XZ compressed file.xz, .txz, .tar.xz
ZIP archive.zip, .jar, .xpi, .wz, .exe
Zoo archive.zoo

Credits

Universal Extractor relies heavily on other programs, and would not be possible without the incredible generosity of the Free Software community. This is a list of all of the applications that are used by, or in the creation of, Universal Extractor:

  • 7-Zip (Igor Pavlov, Open Source) - Excellent general purpose Windows archive utility; used to extract .7z, 7-Zip SFX .exe, .bz2, .cab, .chm, .cpio, .deb, .gz, .iso, .lha, .lz, .lzh, NSIS installer .exe, .rpm, .tar, .xz, .wim, and .Z files (and probably even more that I overlooked)
  • ARC (Howard Chu, Open Source) - ARC archiving utility; used to extract .arc files; Note: binary was obtained from http://gnuwin32.sourceforge.net/packages/arc.htm
  • AspackDie (yoda, Open Source) (homepage seems dead) - Unpacker for ASPack-compressed files; used to unpack .exe files with ASpack compression
  • AutoIt (Jonathan Bennett, Open Source) - General-purpose Windows scripting language; used to write the UniExtract front-end
  • bin2iso (Bob Doiron, Joonas Loppi, Open Source) - Utility to convert BIN/CUE CD-ROM images to ISO images; used in conjunction with 7-Zip to extract .bin/.cue images
  • Barebones Ooz (Booz) - (Rahul Dhesi, Open Source) - Zoo archive extractor/lister; used for extracting .zoo files
  • cdrip (DeXT, Open Source) (homepage seems dead, possible replacement) - Utility to convert DiscJuggler (CDI) CD-ROM images to ISO images; used in conjunction with 7-Zip to extract .cdi images
  • cmdTotal (Adam Blaszczyk, Open Source) - CLI frontend for Total Commander plugins; enables support for the following plugins used by Universal Extractor:
    • DBX (Dmitri R. Letichevski, Freeware) - extracts Outlook Express mail archives
    • InstallExplorer (Domo, Freeware) - Total Commander port of the InstallExplorer plugin for FAR by Sergei Wanin; extracts Gentee, Inno Setup, Installer VISE, InstallShield, NSIS, SetupFactory, and Wise Installer packages
    • MHT Unpacker (Ariel Perez, Freeware) - extracts MHTML files
    • MSI (Alex Gretha, Freeware) - extracts Windows Installer package (MSI) and patch (MSO) files
    • PDunSIS (Patrik Daranský, Freeware) - extracts SIS (SymbianOS) packages
  • Convert LIT (Dan A. Jackson, Open Source) - Converter for Microsoft Reader format e-books; used extract contents from .lit files
  • Crystal SVG (Everaldo Coelho, Free) - Collection of extremely high-quality icons for Linux/KDE; used as the source graphics for the UniExtract icon
  • E_WISE (Veit Kannegieser, Open Source) - Wise Installer decompiler; used for extracting files from Wise Installer packages
  • extract (Gilles Vollant, Freeware) - Floppy disk image extraction utility; used to extract files from .img images
  • ExtractMHT (Jared Breland, Open Source) - Splitter and base64 decoder for MHTML files; used to extract .mht files
  • GIMP (Spencer Kimball and Peter Mattis, Open Source) - The GNU Image Manipulation Program; used to create the icons used by UniExtract
  • HelpDeco (Manfred Winterhoff, Freeware) (homepage seems dead, possible replacement) - Decompiler for Windows Help files; used to extract/reconstruct .hlp files
  • i3comp (Stirling Technologies, Freeware) - InstallShield 3.x Compression and Maintenance utility; used for extracting files from InstallShield 3.x installer packages; can be download as part of WinPack
  • i5comp (fOSSiL, Open Source) - InstallShield 5.x Compression and Maintenance utility; used for extracting files from InstallShield 5.x installer packages; can be download as part of WinPack
  • i6comp (fOSSiL, Morlac, Open Source) - InstallShield 6.x Compression and Maintenance utility; used for extracting files from InstallShield 6.x installer packages; can be download as part of WinPack
  • Info-ZIP UnZip (Info-ZIP, Open Source) - Highly portable ZIP archive utility; used for extracting .zip and ZIP SFX .exe files
  • Inno Setup (Jordan Russell, Open Source) - Open Source packaging application for Windows; used to create the UniExtract installer
  • Innounp (QuickeneR, Open Source) - Inno Setup Unpacker; used for extracting files from Inno Setup installer packages
  • IsXunpack (Pit0n and SkYuS//vN, Freeware) - InstallShield Unpacker; used for extracting files from modern InstallShield installer packages
  • KGB (Thomasz Pawlak, Freeware) - KGB archiver; used to extract .kgb, .kge, and KGB SFX files
  • lzop (Markus F.X.J. Oberhumer, Open Source) - LZO file compression utility; used to extract .lzo files
  • MsiX (Heath Stewart, Open Source) - General purpose stream and transform extractor for Windows Installer files; used to extract files from .msi, .msm, and .msp files
  • NBHextract (pof and TheBlasphemer, Freeware) - Utility to extract contents from NBH files (HTC device ROM images)
  • nrg2iso (Greg Kokanosky, Open Source) - Utility to convert Nero (NRG) CD-ROM images to ISO images; used in conjunction with 7-Zip to extract .nrg images
  • Open-source ARJ (ARJ Software Russia, Open Source) - Open Source implementation of the ARJ archiving utility; used to extract .arj and ARJ SFX .exe files
  • PeaZip (Giorgio Tani, Open Source) - PeaZip archiver; used to extract Pea archives
  • PEiD (Jibz, Qwerton, snaker, and xineohP, Freeware) - Portable Executable File Identifier; used to analyze .exe file signature to determine the filetype and whether or not it's a supported archive; includes Bob's external signature database
  • RAIU (Icebird, Open Source) - Utility to unwrap Reflexive Arcade installers; used in conjunction with innounp to extract Reflect Arcade packages
  • StuffIt Expander 6.0 (Aladdin Systems, Freeware) - StuffIt file decompressor; used for extracting .sit files
  • StIX (Veit Kannegieser, Freeware) - Decompressor for InstallShield 3.x archives and installers; used to extract InstallShield 3.x archives (.1, .lib) and SFX installers (.exe)
  • tee (Free Software Foundation, Open Source) - Shell utility that redirects standard input to multiple outputs; used to write messages to a log file while also displaying current progress; Windows binary was obtained from GNU Utilities for Win32
  • TrID (Marco Pontello, Freeware) - Utility designed to identify file types from their binary signatures; used to determine the type of file passed for extraction
  • UnLZX (Oliver Gantert, Open Source) - LZX file decompression utility; used to extract .lzx files
  • UnRAR (Eugene and Alexander Roshal, Freeware) - Command-line utility for RAR archives; used to extract .rar and RAR SFX .exe files
  • UnUHARC (Uwe Herklotz, Freeware) - Command-line utility for UHARC archives; used to extract .uha files; can no longer find a legitimate source
  • UPX (Markus Oberhumer, Laszlo Molnar & John Reiser, Open Source) - Compression utility for PE files; used to unpack .exe and .dll files with UPX compression
  • UUDeview (Frank Pilhofer, Open Source) - Encoded file decoder; used to decode Base64, UUencoded, XXencoded, and yEnc files
  • WUN (Jägermeister Markus, Icebird, Open Source) - Wise-Setup Unpacker; used for extracting files from Wise Installer packages (updated version of HWUN)
  • XAce (Marcel Lemke, Freeware) - ACE archive utility; used for extracting .ace and ACE SFX .exe files

A decompiler is a computer program that takes an executable file as input, and attempts to create a high level source file which can be recompiled successfully. It is therefore the opposite of a compiler, which takes a source file and makes an executable. Decompilers are usually unable to perfectly reconstruct the original source code, and as such, will frequently produce obfuscated code. Nonetheless, decompilers remain an important tool in the reverse engineering of computer software.

Introduction[edit]

The term decompiler is most commonly applied to a program which translatesexecutable programs (the output from a compiler) into source code in a (relatively) high level language which, when compiled, will produce an executable whose behavior is the same as the original executable program. By comparison, a disassembler translates an executable program into assembly language (and an assembler could be used to assemble it back into an executable program).

Decompilation is the act of using a decompiler, although the term can also refer to the output of a decompiler. It can be used for the recovery of lost source code, and is also useful in some cases for computer security, interoperability and error correction.[1] The success of decompilation depends on the amount of information present in the code being decompiled and the sophistication of the analysis performed on it. The bytecode formats used by many virtual machines (such as the Java Virtual Machine or the .NET FrameworkCommon Language Runtime) often include extensive metadata and high-level features that make decompilation quite feasible. The presence of debug data can make it possible to reproduce the original variable and structure names and even the line numbers. Machine language without such metadata or debug data is much harder to decompile.[2]

Increase carry weight skyrim console code

Some compilers and post-compilation tools produce obfuscated code (that is, they attempt to produce output that is very difficult to decompile). This is done to make it more difficult to reverse engineer the executable.

While decompilers are normally used to (re-)create source code from binary executables, there are also decompilers to turn specific binary data files into human-readable and editable sources.[3][4]

Design[edit]

Decompilers can be thought of as composed of a series of phases each of which contributes specific aspects of the overall decompilation process.

Loader[edit]

The first decompilation phase loads and parses the input machine code or intermediate language program's binary file format. It should be able to discover basic facts about the input program, such as the architecture (Pentium, PowerPC, etc.) and the entry point. In many cases, it should be able to find the equivalent of the main function of a C program, which is the start of the user written code. This excludes the runtime initialization code, which should not be decompiled if possible. If available the symbol tables and debug data are also loaded. The front end may be able to identify the libraries used even if they are linked with the code, this will provide library interfaces. If it can determine the compiler or compilers used it may provide useful information in identifying code idioms.[5]

Disassembly[edit]

The next logical phase is the disassembly of machine code instructions into a machine independent intermediate representation (IR). For example, the Pentium machine instruction

might be translated to the IR

Idioms[edit]

Idiomatic machine code sequences are sequences of code whose combined semantics is not immediately apparent from the instructions' individual semantics. Either as part of the disassembly phase, or as part of later analyses, these idiomatic sequences need to be translated into known equivalent IR. For example, the x86 assembly code:

could be translated to

Some idiomatic sequences are machine independent; some involve only one instruction. For example, xoreax,eax clears the eax register (sets it to zero). This can be implemented with a machine independent simplification rule, such as a = 0.

In general, it is best to delay detection of idiomatic sequences if possible, to later stages that are less affected by instruction ordering. For example, the instruction scheduling phase of a compiler may insert other instructions into an idiomatic sequence, or change the ordering of instructions in the sequence. A pattern matching process in the disassembly phase would probably not recognize the altered pattern. Later phases group instruction expressions into more complex expressions, and modify them into a canonical (standardized) form, making it more likely that even the altered idiom will match a higher level pattern later in the decompilation.

It is particularly important to recognize the compiler idioms for subroutine calls, exception handling, and switch statements. Some languages also have extensive support for strings or long integers.

Program analysis[edit]

Various program analyses can be applied to the IR. In particular, expression propagation combines the semantics of several instructions into more complex expressions. For example,

could result in the following IR after expression propagation:

The resulting expression is more like high level language, and has also eliminated the use of the machine register eax. Later analyses may eliminate the ebx register.

Data flow analysis[edit]

The places where register contents are defined and used must be traced using data flow analysis. The same analysis can be applied to locations that are used for temporaries and local data. A different name can then be formed for each such connected set of value definitions and uses. It is possible that the same local variable location was used for more than one variable in different parts of the original program. Even worse it is possible for the data flow analysis to identify a path whereby a value may flow between two such uses even though it would never actually happen or matter in reality. This may in bad cases lead to needing to define a location as a union of types. The decompiler may allow the user to explicitly break such unnatural dependencies which will lead to clearer code. This of course means a variable is potentially used without being initialized and so indicates a problem in the original program.

Type analysis[edit]

A good machine code decompiler will perform type analysis. Here, the way registers or memory locations are used result in constraints on the possible type of the location. For example, an and instruction implies that the operand is an integer; programs do not use such an operation on floating point values (except in special library code) or on pointers. An add instruction results in three constraints, since the operands may be both integer, or one integer and one pointer (with integer and pointer results respectively; the third constraint comes from the ordering of the two operands when the types are different).[6]

Various high level expressions can be recognized which trigger recognition of structures or arrays. However, it is difficult to distinguish many of the possibilities, because of the freedom that machine code or even some high level languages such as C allow with casts and pointer arithmetic.

The example from the previous section could result in the following high level code:

Structuring[edit]

The penultimate decompilation phase involves structuring of the IR into higher level constructs such as while loops and if/then/else conditional statements. For example, the machine code

could be translated into:

Unstructured code is more difficult to translate into structured code than already structured code. Solutions include replicating some code, or adding boolean variables.[7]

Code generation[edit]

Decompiler Installshield Software

The final phase is the generation of the high level code in the back end of the decompiler. Just as a compiler may have several back ends for generating machine code for different architectures, a decompiler may have several back ends for generating high level code in different high level languages.

Just before code generation, it may be desirable to allow an interactive editing of the IR, perhaps using some form of graphical user interface. This would allow the user to enter comments, and non-generic variable and function names. However, these are almost as easily entered in a post decompilation edit. The user may want to change structural aspects, such as converting a while loop to a for loop. These are less readily modified with a simple text editor, although source code refactoring tools may assist with this process. The user may need to enter information that failed to be identified during the type analysis phase, e.g. modifying a memory expression to an array or structure expression. Finally, incorrect IR may need to be corrected, or changes made to cause the output code to be more readable.

Legality[edit]

The majority of computer programs are covered by copyright laws. Although the precise scope of what is covered by copyright differs from region to region, copyright law generally provides the author (the programmer(s) or employer) with a collection of exclusive rights to the program.[8] These rights include the right to make copies, including copies made into the computer’s RAM (unless creating such a copy is essential for using the program).[9]Since the decompilation process involves making multiple such copies, it is generally prohibited without the authorization of the copyright holder. However, because decompilation is often a necessary step in achieving software interoperability, copyright laws in both the United States and Europe permit decompilation to a limited extent.

In the United States, the copyright fair use defence has been successfully invoked in decompilation cases. For example, in Sega v. Accolade, the court held that Accolade could lawfully engage in decompilation in order to circumvent the software locking mechanism used by Sega's game consoles.[10] Additionally, the Digital Millennium Copyright Act (PUBLIC LAW 105–304[11]) has proper exemptions for both Security Testing and Evaluation in §1205(i), and Reverse Engineering in §1205(f).

In Europe, the 1991 Software Directive explicitly provides for a right to decompile in order to achieve interoperability. The result of a heated debate between, on the one side, software protectionists, and, on the other, academics as well as independent software developers, Article 6 permits decompilation only if a number of conditions are met:

  • First, a person or entity must have a licence to use the program to be decompiled.
  • Second, decompilation must be necessary to achieve interoperability with the target program or other programs. Interoperability information should therefore not be readily available, such as through manuals or API documentation. This is an important limitation. The necessity must be proven by the decompiler. The purpose of this important limitation is primarily to provide an incentive for developers to document and disclose their products' interoperability information.[12]
  • Third, the decompilation process must, if possible, be confined to the parts of the target program relevant to interoperability. Since one of the purposes of decompilation is to gain an understanding of the program structure, this third limitation may be difficult to meet. Again, the burden of proof is on the decompiler.

In addition, Article 6 prescribes that the information obtained through decompilation may not be used for other purposes and that it may not be given to others.

Overall, the decompilation right provided by Article 6 codifies what is claimed to be common practice in the software industry. Few European lawsuits are known to have emerged from the decompilation right. This could be interpreted as meaning one of three things: 1) the decompilation right is not used frequently and the decompilation right may therefore have been unnecessary, 2) the decompilation right functions well and provides sufficient legal certainty not to give rise to legal disputes or 3) illegal decompilation goes largely undetected. In a recent report regarding implementation of the Software Directive by the European member states, the European Commission seems to support the second interpretation.[13]

Tools[edit]

Decompilers usually target a specific binary format. Some are native instruction sets (eg Intel x86, ARM, MIPS), others are bytecode for virtual machines (Dalvik, Java class files, WebAssembly, Ethereum).

Due to information loss during compilation, decompilation is almost never perfect, and not all decompilers perform equally well for a given binary format. There are studies comparing the performance of different decompilers.[14]

See also[edit]

  • JEB Decompiler (Android Dalvik, Intel x86, ARM, MIPS, WebAssembly, Ethereum)

References[edit]

  1. ^Van Emmerik, Mike (2005-04-29). 'Why Decompilation'. Program-transformation.org. Retrieved 2010-09-15.
  2. ^Miecznikowski, Jerome; Hendren, Laurie (2002). 'Decompiling Java Bytecode: Problems, Traps and Pitfalls'. In Horspool, R. Nigel (ed.). Compiler Construction: 11th International Conference, proceedings / CC 2002. Springer-Verlag. pp. 111–127. ISBN3-540-43369-4.
  3. ^Paul, Matthias R. (2001-06-10) [1995]. 'Format description of DOS, OS/2, and Windows NT .CPI, and Linux .CP files' (CPI.LST file) (1.30 ed.). Archived from the original on 2016-04-20. Retrieved 2016-08-20.
  4. ^Paul, Matthias R. (2002-05-13). '[fd-dev] mkeyb'. freedos-dev. Archived from the original on 2018-09-10. Retrieved 2018-09-10. […] .CPI & .CP codepage file analyzer, validator and decompiler […] Overview on /Style parameters: […] ASM source include files […] Standalone ASM source files […] Modular ASM source files […]
  5. ^Cifuentes, Cristina; Gough, K. John (July 1995). 'Decompilation of Binary Programs'. Software Practice and Experience. 25 (7): 811–829. CiteSeerX10.1.1.14.8073. doi:10.1002/spe.4380250706.
  6. ^Mycroft, Alan (1999). 'Type-Based Decompilation'. In Swierstra, S. Doaitse (ed.). Programming languages and systems: 8th European Symposium on Programming Languages and Systems. Springer-Verlag. pp. 208–223. ISBN3-540-65699-5.
  7. ^Cifuentes, Cristina (1994). 'Chapter 6'. Reverse Compilation Techniques(PDF) (PhD thesis). Queensland University of Technology. Archived(PDF) from the original on 2016-11-22. Retrieved 2019-12-21.)
  8. ^Rowland, Diane (2005). Information technology law (3 ed.). Cavendish. ISBN1-85941-756-6.
  9. ^'U.S. Copyright Office - Copyright Law: Chapter 1'.
  10. ^'The Legality of Decompilation'. Program-transformation.org. 2004-12-03. Retrieved 2010-09-15.
  11. ^'Digital Millennium Copyright Act'(PDF). US Congress. 1998-10-28. Retrieved 2013-11-15.
  12. ^Czarnota, Bridget; Hart, Robert J. (1991). Legal protection of computer programs in Europe: a guide to the EC directive. London: Butterworths Tolley. ISBN0-40600542-7.
  13. ^'EUR-Lex - 52000DC0199 - EN'.
  14. ^Harrand, Nicolas; Soto-Valero, Cesar; Monperrus, Martin; Baudry, Benoit (2019). 'The Strengths and Behavioral Quirks of Java Bytecode Decompilers'. 19th International Working Conference on Source Code Analysis and Manipulation (SCAM). IEEE: 92–102. arXiv:1908.06895. Bibcode:2019arXiv190806895H. doi:10.1109/SCAM.2019.00019. ISBN978-1-7281-4937-0.

External links[edit]

Look up decompiler in Wiktionary, the free dictionary.
Wikibooks has a book on the topic of: Reverse Engineering
  • Decompilers and Disassemblers at Curlie
Retrieved from 'https://en.wikipedia.org/w/index.php?title=Decompiler&oldid=954364856'