Decompilation of Selected Parts of the Executable File
By using the
Selected Functions and
Selected Ranges options above, you can decompile only parts of the input binary file. More specifically, when you select
Selected Functions, you can specify a list of functions to be decompiled. Similarly, when you select
Selected Ranges, you can specify a list of address ranges to be decompiled. These options are useful if the decompilation of the whole binary file takes too much time.
Decompilation of Selected Functions
The list of functions is supposed to be of the following format:
func1, func2, func3, where each
funcX is the name of a function in the binary file. Whitespace between the names of functions is irrelevant. The only restriction is that the functions have to be separated by commas.
If you are not sure what functions are available in the binary file, you can inspect it by using a program that supports the analysis of binary files, such as
readelf on Linux. Always look for the list of symbols that are defined in the file. Example:
$ readelf -Ws file.elf
> Symbol table '.symtab' contains 105 entries:
> Num: Value Size Type Bind Vis Ndx Name
> 52: 08048b00 1962 FUNC GLOBAL DEFAULT 12 MD5Transform
> 53: 00000000 0 NOTYPE WEAK DEFAULT UND _ITM_deregisterTMCloneTable
> 54: 080493f0 384 FUNC GLOBAL DEFAULT 12 MD5Update
To decompile just the
functions, specify them in the
input field in the decompilation form above.
Another way is to use our online file-information service. Simply select your binary file, click on
Analyze, and search for the
Symbol table entry in the generated output. More specifically, search for symbols that are of type
FUNCTION. Then, specify the functions you want to decompile in the
Functions input field above.
Either way, make sure that the functions you select are indeed defined in the provided executable file. As a hint, their address is typically inside of some code section. Function lists provided by programs like
objdump, or our online file-information service may also include imported functions, whose addresses are typically inside of a
.plt or similar section, or other objects not suitable for decompilation. If the decompilation with the selected functions still takes too long, try to set explicit address ranges to be decompiled.
Decompilation of Selected Address Ranges
Each address range is supposed to be of the following format:
FIRST_ADDRESS-LAST_ADDRESS, where each address is written in the hexadecimal format. Example:
0x1000-0x2000. To specify multiple ranges, separate them by commas. Example:
0x1000-0x2000, 0x4000-0x5000. Whitespace is irrelevant.
Again, if you are unsure what ranges to select, use a file-analyzing utility to get them. Just like when deciding what functions to specify, you can use our online file-information service to see what addresses are present in the input binary file.
What to Decode
By using the
Decode option in the form above, you can select what the decompiler should decode. If you choose
Everything (the default), all instructions in the input binary file are decoded. The advantage is that by decoding all instructions in the input file, the decompiler is able to provide more precise results at the cost of longer decompilation time. If you choose
Only, then only the instructions in the selected functions or address ranges are decompiled. Here, the advantage is faster decompilation. However, the generated results will most likely be less precise because by decoding only some of the instructions, the context is lost.
Please note that the choice of the decoding option has no impact on the fact that only the selected functions or address ranges are decompiled, even if you choose
Only. To get the most precise results, try the decompilation first with
Everything (the default), and if that fails or takes too long, select