Hacker News Reader

Comment by alexozer | Hacker News Reader

I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast.

I'm wondering this too. I haven't heard of retdec being used too much, but it looks very cool. I'll guess that Hex-Rays is better, but I still am interested in the opinion of someone more experienced who has tried retdec.

I'll go one better: I've contributed patches to retdec.

Retdec is ... okay.

On small binaries it's usable. On even average sized windows binaries (a few meg), not really.

Like on things that IDA takes 10-15 minutes and a reasonable amount of memory (like a 7 meg windows binary), retdec can take forever and unlimited amounts of memory.

I started fixing a lot of the memory issues (completely recursive CFG traversal, etc), but there are also very serious algorithmic issues (N^3/N^4 algorithms in the optimizers).

If i disable a lot of the backend optimizers, i can make it work okay.

But then the output is also a lot larger/worse. To be fair: It used to be about 50x bigger than similar IDA output. The latest development version of retdec now has a new backend IR converter, and the output is only 5x-10x bigger than IDA output.

So as a TL;DR: retdec in its default state is unusable for anything but small binaries. If you understand what is going on, you can get it to work on a lot of binaries as long as you have a ton of memory and time to spare.

Retdec is based in part on Capstone, like Hopper.

I believe Capstone is merely a disassembly framework, and retdec's decompilation process is custom implementation which works on LLVM IR.

Yeah, sorry, as I understand it, it uses Capstone as the disassembler and implements an LLVM lifter over it. It was pretty dumb to describe it as "based on Capstone"; I was just mentally breaking tools down by which CFG recovery system it relied on.

No worries, it wasn't dumb to say that! Your intention just wasn't 100% clear to me.

Reply on news.ycombinator.com