Comment by viraptor | Hacker News Reader

Comment by viraptor | Hacker News Reader

Parent Full thread

I really don't think so. The decompilation result is genuinely silly. For example look at:

    if (*(int*)(local2 + global0) == 0x4550) {
        local5 = *(unsigned short*)(local2 + global0 + 20);

Either local2 or global0 are pointers to a structure. Neither is detected. Most sensible decompilers would change the names and just make it `local5 = global0[local2].blah` instead. Advanced decompilers also can avoid gotos in almost any case. It also uses function calls without parameters or output, assuming some stack layout probably.

It's a really really bad output, not a result of obscured compilation.

I've seen HexRays do the same thing - most of the time you need to actually tell it that a variable is a pointer before it tries to do that.

Stating the function type explicitly also helps it display the right arguments given to it. This output could be significantly improved if the assembly version were available as well.

This came from one of the better known commercial decompilers. Which ones do you consider 'advanced'?

Pointed out before: http://news.ycombinator.com/item?id=2214052 - this is from boomerang - not a known commercial decompiler really.

Hex-rays is much much better than this. You'll have to see the actual output to understand, but at least here are some examples. It does not do such a bad job with type identification, although it certainly isn't perfect.

http://www.hex-rays.com/hexcomp11.shtml

Reply on news.ycombinator.com