Famous Last Words: You can't decompile a C++ program

The Great Jack Schitt writes "I've always heard that you couldn't decompile a program written with C++. This article describes how to do it. It's a bit lengthy and it doesn't seem like the author usually writes in English, but it might just work (haven't tried it, but will when I have time)."

Comments

You can't

[Anonymous Coward]

Information is lost in compilation. You can never reconstruct the exact original source. You end up with valid C++ that has no more human-understandable information than the equivilent machine code.

Like turning hamburgers into cows...

Re:You can't

[Morologous]

Like turning hamburgers into cows...

I'm going to use that line.

Re:You can't

[NewbieProgrammerMan]

Heh. You're assuming that you're attempting to decompile something that had human-understandable source to start with. :)

Re:You can't

[cperciva]

We're talking about C++ here, not perl.

Compiled C++ code can't be decompiled into anything approximating the readability of the original; compiled perl code can.

Re:You can't

[Paradise Pete]

I'd prefer... Like turning shit backing into pizza.

Clearly you haven't tried Domino's.

Oop

[Suffering Bastard]

it doesn't seem like the author usually writes in English

Surely he now understands the English infinitive "to be Slashdotted".

Why not?

[bazik]

I've always heard that you couldn't decompile a program written with C++.

Well, you can decompile every binary programm at least to assembler code, so why shouldnt it possible with C++?

Maybe he ment "you can't decipher the source of a C++ programm" ;)

hmm

[Graspee_Leemoor]

A c/c++ decompiler that totally worked would be the Holy Grail of crackers. Unfortunately it is actually impossible to get everything back because lots of info is lost on compilation.

Nevertheless there are tools out there that attempt to decompile programs; I think of them more as ways of making assembly more readable.

Note, a lot of them wouldn't work on hand-written assembly, because they rely on knowledge of how certain compilers compile various things- e.g. there was a Delphi decompile available.

graspee

Re:hmm

[jackb_guppy]

I wrote reverse compilers on IBM midrange equipment. where there are not stacks and self modifing code is VERY commom place. It is easy to do:

Create a program that preforms / understands the opcodes for the processor and addressing. And it follows both sides of a branch.

Now "run" the program, that maps out the all opcode and data areas.

Once done. Look at that Assemmebler equivatlent, map out commom subroutines and function calls. Data Storage become very clear. Lastly, commom storage with show external and internal common structures - so naming of fields and visualable.

It is striaght forward, can be time comsuming - and very helpful is understnad hinden or loss information.

sure you can go from asm - c++

[Anonymous Coward]

but it'll look like this

class a
{
public:
void b(int c);
void d(int e);
private:
int g;
int h;
};

int main()
{
a f;
f.b(23);

int x; x=0; x++;
if(x > 3) goto j;
f.d(x); x++
if(x > 3) goto j;
f.d(x); x++;
if(x > 3) goto j;
f.d(x);
j: f.b(42);

return 0;
}

Re:Why

[Anonymous Coward]

You need reasons?

1) Finding backdoors
2) Testing security
3) Fixing bugs
4) Adding features
5) Discovering copyright violations
6) Interfacing to non-supported clients

Pretty much anything and everything you would do if you had the source.

let's get back to basics

[1nv4d3r]

Hell, I'd be happy if the people working for me could consistently compile their c/c++. I need a new job...

Spectulation Code

[Davak]

Considering the entire post is evidently based on speculation...

Here is some code that supposedly decomplies... not that I've tried it.

Quote from the FAQ:

[35.4] How can I decompile an executable program back into C++ source code?

You gotta be kidding, right?

Here are a few of the many reasons this is not even remotely feasible:
* What makes you think the program was written in C++ to begin with?
* Even if you are sure it was originally written (at least partially) in C++,
which one of the gazillion C++ compilers produced it?
* Even if you know the compiler, which particular version of the compiler was
used?
* Even if you know the compiler's manufacturer and version number, what
compile-time options were used?
* Even if you know the compiler's manufacturer and version number and
compile-time options, what third party libraries were linked-in, and what
was their version?
* Even if you know all that stuff, most executables have had their debugging
information stripped out, so the resulting decompiled code will be totally
unreadable.
* Even if you know everything about the compiler, manufacturer, version
number, compile-time options, third party libraries, and debugging
information, the cost of writing a decompiler that works with even one
particular compiler and has even a modest success rate at generating code
would be significant -- on the par with writing the compiler itself from
scratch.

But the biggest question is not how you can decompile someone's code, but why
do you want to do this? If you're trying to reverse-engineer someone else's
code, shame on you; go find honest work. If you're trying to recover from
losing your own source, the best suggestion I have is to make better backups
next time.

I would have posted AC but that have me blocked out for some reason...

Davak

You're right, that is nonsense.

[Anonymous Coward]

I damn well know computers. I have been working with them since 1904, when the Black Man made the first computer out of a peanut. I now work for Cray research making 18 figures.

I can scratch a superscalar CPU out of silicon with a pocket knife. I even have friends who can write major programs in binary code (yes, just 1s and 0s)... even though writing a simple "hello world" program can ammount to 92,752 bits. I fail to realize that this ability does not a good computer scientist make. Things like intelligent design and research make a CS good.

The parent post is fluff. It's stupid, the man is flamboyant and exagerating. He clearly has no real education of computer engineering and does not recognize that any executable code can be reverse-engineered or decompiled. Especially since every langage (save interpreted languages like Java) are compiled to machine code -- specific, unambiguous, structured code. "Decompiling" this is only really a matter of translating it into your langauge of choice.

So, Mr. Proud American, please get off your imaginary high horse. You're not fooling anyone.

From the author

[opcodevoid]

I didn't relize my artical was getting any feedback because people are posting it here instead of pscode.

Anyway i seen alot of people saying decompiling is impossible or at least not practical, well that is not true. Decompiling c++ is very practical because of high level keywords(if,while,for) ,local variables, and parameters. All of these generate certain instruction similer on every platform and just about every proccesser.

I also extending the artical to contain 92 pages in total which will cover OOP, and crt, and a whole bunch of other stuff