What is New
Want to see all news? Click here.
New Version: 2.225 Aug 2016
We are proud to release a brand new version of the retargetable decompiler. Among its main features are a decompilation plugin for the IDA disassembler, implementation of a loader for all the supported file formats, and added support for decompilation of archives, object files, and files in the Intel HEX format.
A list of changes:
- Publicly released an experimental version of our decompilation plugin for the IDA disassembler.
- Implemented a loader for all the supported file formats, which improves decompilation results.
- Added support for decompilation of archives (
arformat) and object files. Archives are statically linked libraries, commonly ending with
- Added support for decompilation of files in the Intel HEX format.
- Added detection of various YARA patterns (e.g. used cryptographic constants). Their presence is used to improve decompilation results. They are shown in comments in the generated C source code.
- Improved unpacking of UPX-packed binaries.
- Improved recognition of statically linked code.
- Improved reconstruction of return types and arguments for external functions.
- Reworked how raw machine code is decompiled so you no longer have to select a file format.
- Changes in our fileinfo service:
- It can now emit the output in the JSON format. Set "Output format" to "JSON" via settings when using the service.
- It now produces more information about input files. For example, it now includes hashes (file, sections, imports), relocation tables for the COFF format, detected YARA patterns (e.g. used cryptographic constants), and information about resources and certificates.
- Changes in our REST API:
- Added support for decompilation of files in archives (
arformat). To decompile a file from an archive, use the bin mode and pass either the index of the file in the archive (
ar_index) or its name (
- Added support for decompilation of files in the Intel HEX format. To decompile such files, use the
binmode and pass the architecture and endianness of the machine code inside the file.
raw_section_vmaparameters in raw decompilations no longer accept the
defaultvalue. In both cases, you have to explicitly pass an address.
raw_endianparameter was renamed to
endian. Use of the original name is still supported, but it is deprecated.
- It is no longer required to set
file_formatin raw decompilations. When given, it will be ignored.
- It is no longer possible to force an architecture when decompiling a file in the
binmode. The architecture is now detected automatically from the input file.
- Compiler-optimization levels can now be also specified without the leading dash (e.g. you can pass
- Added a new optional parameter
output_formatto the fileinfo service. You can use it to obtain the output in the JSON format. A related change is that the extension of the output file now depends on the output format.
- Changes in our IDA plugin:
- Added support for decompilation of COFF object files.
- Added support for decompilation of Intel HEX files.
- Added support for decompilation of files containing just raw machine code.
- Added generation of IDA comments into C files generated by full decompilation.
- The plugin no longer performs automatic decompilation of the opened file upon the start of IDA.
- The plugin no longer ignores statically linked functions when selective decompilation is invoked through IDA.
- The plugin does not allow decompilation of non-existing files like objects extracted from archives.
- The plugin does not allow decompilations that it cannot properly handle.
- Many bug fixes.