Search the Community

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.4.7 Features [core] Inline lambdas by instance field (#1800) [plugins] Allow to load classes using input stream or byte array in jadx-input plugin (#1457) Bug Fixes [core] Restore missing type parameter declarations (#1800) [core] Filter invalid chars in app name for gradle export (PR #1813) [core] Correct args shift for instance invoke-custom (#1816) [core] Additional checks to forbid inline of null consts (#1828) [core] Use strict patterns for synthetic methods inline (#1829) [res] Resolve manifest decoding error Expected strings start (#1797)(PR #1798) [res] Handle RES_TABLE_TYPE_OVERLAY (#1748) (PR #1804) [res] Parsing of sparse RES_TABLE_TYPE_TYPE and RES_TABLE_TYPE_STAGED_ALIAS chunks (#1806 #1803)(PR #1807) [res] Resolve int hex attributes [res] Resolve custom attributes [res] Resolve declare-styleable atrributes [res] Set empty parent for styles without a parent, remove duplicated code Use parent attribute only for styles (PR #1815) [gui] Search constant fields usage in all classes (#1801) [gui] Redirect jump from search for inlined classes [gui] Show skipped resources count during search (#1808) [gui] Update Messages_zh_CN.properties (PR #1811) [debugger] Process UI updates in correct thread (#1796) [cli] Make enum CLI arguments match documented format (PR #1787) [hide][Hidden Content]]

Reverse Engineering for Professionals. Decompile and debug binary code. Break down and analyze document files. Android Dalvik, Intel x86, ARM, MIPS, RISC-V, S7 PLC, Java, WebAssembly & Ethereum Decompilers. This is JEB Decompiler as cracked by CXV, which was found on publicly accessible exetools.com pages Requirements: JDK 11.0.X 64 bit, 64-bit OS Mod by CXV Press Generate a Key in welcome window - fix all integrity checks\timebomb - Time-limited sessions fixed - Requires an Internet connection fixed - dexdec: fix string decrypt via emulation - dexdec: instruction conversion recovered - gui: Usage of the clipboard is disallowed fixed - jdb2: Saving or loading projects is disabled fixed - android debug enabled - avrdec: decompiler enabled - Decompiler exporter fixed - callgraph enabled Increase available RAM in jvm up to 4gb: rename jvmopt.txt.TEMPLATE -> jvmopt.txt [Hidden Content] [hide][Hidden Content]]

Reverse Engineering for Professionals. Decompile and debug binary code. Break down and analyze document files. Android Dalvik, Intel x86, ARM, MIPS, RISC-V, S7 PLC, Java, WebAssembly & Ethereum Decompilers. This is JEB Decompiler as cracked by CXV, Requirements: JDK 11.0.X 64 bit, 64-bit OS Mod by CXV Press Generate a Key in welcome window - fix all integrity checks\timebomb - Time-limited sessions fixed - Requires an Internet connection fixed - dexdec: fix string decrypt via emulation - dexdec: instruction conversion recovered - gui: Usage of the clipboard is disallowed fixed - jdb2: Saving or loading projects is disabled fixed - android debug enabled - avrdec: decompiler enabled - Decompiler exporter fixed - callgraph enabled Increase available RAM in jvm up to 4gb: rename jvmopt.txt.TEMPLATE -> jvmopt.txt [Hidden Content] [hide][Hidden Content]]

Reverse Engineering for Professionals. Decompile and debug binary code. Break down and analyze document files. Android Dalvik, Intel x86, ARM, MIPS, RISC-V, S7 PLC, Java, WebAssembly & Ethereum Decompilers. Requirements: JDK 11.0.X 64 bit, 64-bit OS Press Generate a Key in welcome window - fix all integrity checks\timebomb - Time-limited sessions fixed - Requires an Internet connection fixed - dexdec: fix string decrypt via emulation - dexdec: instruction conversion recovered - gui: Usage of the clipboard is disallowed fixed - jdb2: Saving or loading projects is disabled fixed - android debug enabled - android native debug enabled - avrdec: decompiler enabled - Decompiler exporter fixed - callgraph enabled [Hidden Content] [Hidden Content]

RetDec is a retargetable machine-code decompiler based on LLVM. The decompiler is not limited to any particular target architecture, operating system, or executable file format: Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code. Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC. Features: Static analysis of executable files with detailed information. Compiler and packer detection. Loading and instruction decoding. Signature-based removal of statically linked library code. Extraction and utilization of debugging information (DWARF, PDB). Reconstruction of instruction idioms. Detection and reconstruction of C++ class hierarchies (RTTI, vtables). Demangling of symbols from C++ binaries (GCC, MSVC, Borland). Reconstruction of functions, types, and high-level constructs. Integrated disassembler. Output in two high-level languages: C and a Python-like language. Generation of call graphs, control-flow graphs, and various statistics. Changelog v5.0 The one major change: RetDec is now a library (#779. Related changes are the removal of retdec-decompiler.py (it is now a binary, e.g. retdec-decompiler.exe on Windows), retdec-bin2llvmir, retdec-llvmir2hll, and some other supportive functionality. See an example in src/retdectool, or an actual implementation of RetDec executable in src/retdec-decompiler, to find out how to use RetDec library. [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.4.4 Features [gui] Add manual search, stop and sort actions to search dialog (#1600) [gui] Save project search history [gui] Show start page on jadx open [gui] Add Brazilian Portuguese translation (PR #1596) Select better resource name (#1581) Add option to disable finally block extraction (#1592) Bug Fixes Resolve inherited method to use correct alias (#1582) Check variables before merge in finally block (#1592) Checks for field init reorder (#1599) Handle empty endless loop (#1611) Improve top block search for try/catch (#1633) UnsupportedOperationException on adding a field (#1645)(PR #1646) Don’t inline anonymous in self inner class (#1645) [gui] Improve search dialog performance [gui] Improve resources search (#1648) [gui] Improve log viewer dialog (#1311)(PR #1649) [gui] Add constructors usage into class usage (#1591) [gui] Sort resources by deobfuscated name (#1595)(PR #1598) [gui] Correct Frida snippet for constructor (PR #1605) [gui] Fix broken FileDialog by using legacy sort (#1628)(PR #1630) [gui] Handle possible classes overlap in disk cache (#1633) [gui] Disable actions if files not loaded (#1644) [debugger] Resolve NPE in adb device viewer (#1585) (PR #1586) [res] XML “null” decoding (#1583)(PR #1594) [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.4.2 Features [gui] Support export to various deobfuscation mapping file formats (#1491)(PR #1505) [gui] Add reload and live reload actions (#1537) [gui] Allow to disable jump on double click (#1540) Bug Fixes [cli] Allow decoding resource-only APKs (#1517)(PR #1530) [cli] Remove deprecated --deobf-rewrite-cfg (#1513) [gui] Try to prevent jadx node leaks in UI objects [gui] Improve restoration of windows saved state (PR #1511) [gui] Add volatile and update sync for decompiler field in wrapper (#1518) [gui] Resolve popup menu action run (#1514, #1529) [gui] Correct set highlighted text in search (#1507) [gui] Allow to select file on mapping export [gui] Reset disk cache on new jadx version [gui] Force jadx new version check by default Improve blocks tree compare for finally extract (#1501) Support all-catch in multi-catch (#1510) Improve class search for super call (#1512) Keep types on duplicate cast remove (#1527) Check class name collisions (#1526) Use wide move for long/double store/load java opcodes [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Dependency updates: Updated dnlib to 3.5.0 Updated Iced to 1.17.0 Roslyn compiler to 4.1.0 Ookii.Dialogs.Wpf to 5.0.1 VS MEF to 16.9.20 ILSpy to 2.4 Mono.Debugger.Soft was updated to the latest commit. [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Changelog v6.2 RC2 Add support for searching by full name by @mobile46. Improvements to GitHub Actions workflow by @Gorialis. Optimized search module by reducing memory allocations. Use .NET Standard instead of .NET Framework for Roslyn projects by @mobile46 fixing #84. Micro-optimizations in various places. Fixed decompiler creating incorrect checked regions for some post increments. dnSpy now reads assembly resolution probe paths from .config files. [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.4 Features [gui] Disk code cache and search rewrite (PR #1483) Allow to load custom input (#1457) Allow to include/exclude dependencies when saving with class filter (#1466)(PR #1467) Bug Fixes [cli] Don’t ignore critical errors (#1150) [gui] Resolve NPE on project save (#1463)(PR #1464) [gui] Confirm directory loading on file open (#1462) [gui] Fix IndexOutOfBoundsException when switching between tabs via mouse wheel (#1456)(PR #1469) [gui] Editor theme loading and error/fallback handling improved (#1476)(PR #1478) [gui] Ask for project file path on exit (#1474) [gui] Escape class, method and field names in Frida code snippet (PR #1480) [gui] Add missing Use debug info option [gui] Use alias for types in tooltips (#1487) Better code styling for if-else blocks (#1455) Workaround to prevent incorrect order after move inline (#1472) Use alias for variable names (#1487) Breaking changes in Jadx API ICodeInfo: lines and code annotations moved to new interface ICodeMetadata with helpful search methods Changes for all code annotations methods to use ICodeAnnotation instead plain Object. [hide][Hidden Content]]

dnSpy is a tool to reverse engineer .NET assemblies. It includes a decompiler, a debugger and an assembly editor (and more) and can be easily extended by writing your own extension. It uses dnlib to read and write assemblies so it can handle obfuscated assemblies (eg. malware) without crashing. Features Open Source (GPLv3) and Free Forever (:TM:) Assembly Editor Use C# or Visual Basic to edit any method, property and event Code editor has IntelliSense (code completion, signature help, quick info) Whole classes can be added to assemblies by adding C# and Visual Basic code Edit all metadata of types (classes), methods, properties, events, fields Add, remove, rename any type (class), method, property, event, field Edit, add, remove .NET resources and save them to disk The IL editor allows editing method bodies at the IL level: IL instructions, locals, exception handlers Debugger Debug any .NET assembly, no source code required Set breakpoints in any assembly, including framework assemblies, assemblies in the GAC and assemblies existing only in memory Memory window Output window Attach to process Locals window raw contents of locals (eg. decrypted byte arrays) can be saved to disk Call Stack window Threads window Modules window Modules (eg. decrypted in-memory modules) can be saved to disk Exception Settings Can debug dynamic assemblies Debugging CoreCLR assemblies is supported Decompile to C#, Visual Basic, IL Themes: blue, dark, light (and high contrast) Supports smaller screens (eg. laptops) Line height can be optimized for smaller screens Blank and non-alphanumeric lines are 75% the normal height No extra spacing between lines (saves 1 vertical pixel per line) Menu and toolbar share the same line Full screen mode (Shift+Alt+Enter) saves some vertical pixels High DPI support and per-monitor DPI-aware Translated to several languages Highly extensible Write your own extensions and add your own features All major features are already extensions (assembly editor, debugger, decompiler) Multiple tabs and tab groups Your screen is too big? Don’t cut it in half, add another vertical tab group and read two classes at once! The tabs and positions within the text editors are saved when you close dnSpy and restored at startup so you can continue where you left off Search assemblies Search for types (classes), methods, properties, events, fields Search for strings or numbers in code Assembly analyzer Find usages of types (classes), methods, properties, events, fields BAML to XAML decompiler Fast Highlighted references, keywords References under the caret are highlighted to make it easier to see all uses of the reference in the code Tab, Shift+Tab, Ctrl+Shift+Up, Ctrl+Shift+Down moves to the next or previous reference Alt+Down and Alt+Up moves to the next or previous definition (type (class), method, property, event, field) Structure visualizer Vertical guide lines shown between start and end of code blocks Different colors are used for different blocks, eg. loop, conditional, method, etc dnlib is used to read and write assemblies so it can handle obfuscated code (eg. malware) without crashing Go to commands: Entry point Assembly static initialization method (<Module>..cctor) Any metadata token Any metadata row Syntax highlighted tooltips with XML doc comments when hovering over a type (class), method, property, event, field Methods, properties and events are decompiled in source code order or a custom user-defined order Source code order means that related methods are usually next to each other, just like the programmer wanted Background images can be shown in the text editor Export to project decompiles all selected assemblies and creates a Visual Studio solution Multiple assemblies can be exported at the same time Creates a Visual Studio solution (supports VS2005 – VS-latest) and project files Supports WinForms and WPF classes (creates a code-behind .cs/.vb file and a WinForms .resx / WPF .xaml file) Converts .NET resources to .resx files Open from GAC Command line decompiler Supports Windows, Linux and Mac Syntax highlights output to the screen Scripting with C# REPL Call public dnSpy methods from scripts Script the debugger and other extensions Hex editor Method tokens and addresses are shown in comments and can be clicked to go to the raw metadata or IL bytes Metadata editor Collapse Assembly Explorer nodes command to quickly collapse unused nodes And more… Changelog v6.2 RC1 New features: dnSpy now runs under .NET 6 and .NET Framework 4.8. Move to VS2022 icons for UI and exe files (by @InKahootz and @SychicBoy) Support for tilt/horizontal scrolling in the UI. Added support for editing custom attributes on module resources. Added support for modifying the Log2Rid value when saving the module. Add support for ARM64 target architecture in the assembly editor. Add an enum for PE Magic field in the PE editor (by @riQQ) Show debugged process’s name in the title bar (by @InKahootz) Add support for writing VS2022 compatible .sln files. Added back the Save Code, Save BAML, and Save XAML options in the File context menu which save the contents of the currently open document tab. Debugger: Display a warning message before starting to debug a target file with a different bitness than the current dnSpy version running. Add a new option that allows to automatically break on <Module>::.cctor when starting to debug. Display the exception’s HResult property when an unhandled exception is hit. ILSpy decompiler: Added jump to reference support for jmp() expressions created when the jmp CIL opcode is present. CIL disassembler now includes information about generic parameter attributes and constraints. Add more information to the output when disassembling the module node when using the CIL disassembler. The decompiler now splits up long method call chains using a new line. Generate debug info for yield break; statements. Improvements and bug fixes: Fix the .NET 6 console executable having the incorrect subsystem set in the PE options resulting in a crash. Fixed escaping of namespaces in tooltips. Fixed syntax highlighting for structs in tooltips. Improved RVA <-> FileOffset conversions in PE editor to fix a crash with invalid values being passed in. Improved assembly resolution for .NET Standard, .NET Core, .NET 5, .NET 6. Read probe paths from .config files when searching for satellite assemblies during project export. Fixed incorrect label in the Save Module dialog. ILSpy Decompiler Optimized the variable naming step in the decompiler by reducing memory allocations. Improved insertion of checked() blocks. Improved decompilation of query expressions. Prevent delegate construction decompilation from crashing the entire decompiler if it failed. Improved analysis for unsafe modifier. Ignore invalid prefixes when constructing the ILAst. This prevents a common method used to crash the decompiler from working. Many improvements and fixes to the async method decompilation logic. Optimized the removal of dead nop instructions when building the ILAst. This deficiency was a known method to crash dnSpy’s decompiler by filling a method body with huge amounts of useless code. Fixed a rare case where field initializers would not be detected properly. Fixed a rarely occurring bug that resulted in incorrect ILAst being built. Optimized construction of ILAst by calculating the stack behavior of instruction only once and by caching the result of MethodDef.HasReturnType. Improved required parenthesis analysis. Debugger: Fixed a bug that caused the infamous ??? exception to occur when debugging. Improved debugging support for newer mono runtimes. Fixed a crash that occurred in the .NET Framework version of dnSpy when a module loaded into memory during debugging would contain an invalid file path resulting in a crash. BAML decompiler Resolve namespaces of properties. Fix Name attribute for properties incorrect in rare circumstances. Fix missing x:Static and x:Type (by @wwh1004) Dependency updates: Updated dnlib to 3.5.0 Updated Iced to 1.17.0 Roslyn compiler to 4.1.0 Ookii.Dialogs.Wpf to 5.0.1 VS MEF to 16.9.20 ILSpy to 2.4 Mono.Debugger.Soft was updated to the latest commit. [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.3.5 Features Add ‘simple’ decompilation mode [gui] Add split view for different decompilation modes Bug Fixes Handle inlined classes while collecting override related methods (#1422) Use correct reference for replaced bridge constructor (#1441) Handle wildcard in invoke type resolver (#1238) Update class set to Android 32 Replace fixed memory limit with -XX:MaxRAMPercentage=70.0 (#1437) Various minor improvements (PR #1418) [cli] Use correct converter for “–decompilation-mode” option (#1434)(PR #1435) [debugger] Resolve IO read problems, proper socket closing (PR #1414) [deobf] Fix writing method mappings as fields entries (#1432)(PR #1433) [gui] Rename class while rename constructor (#1441) [gui] Restore open tabs on project load (regression fix) [gui] Don’t highlight whitespaces and special symbols (#1429) [gui] Check free memory after GC attempt [gui] Update Traditional Chinese translation (PR #1452) [res] Ignore resource chunk entries that are located after the resource chunk end (#751)(PR #1436) [hide][Hidden Content]]

Reko (Swedish: “decent, obliging”) is a C# project containing a decompiler for machine code binaries. This project is freely available under the GNU General Public License. Changelog v0.11.1 This maintenance release provides minor enhancements and bugfixes, including: More ARM32 rewriters. More uses of generic IntrinsicProcedures. Replace recursive SccFinder with an non-recursive implementation. Initial support for Terse Executable format. Don’t try tracing into nonexecutable code. Ctrl+0 resets the zoom level of the Graph Viewer Many more PowerPC instructions supported C parser issues reported by @smx-smx Make SSA analysis use bit-accurate analysis for stack variables. Multithreaded robustness. It also has some refactorings and new classes, setting the stage for a future refactoring of the Scanner: New RtlSwitch subclass of RtlInstruction Support for platform-specific patterns for procedure entries. [hide][Hidden Content]]

GDA(GJoy Dex Analysizer) Most reverse engineers mainly use Java decompiler, commercial Dalvik decompiler Jeb, and smali2java to analyze Android APPs. Java decompiler is based on Java bytecode, including JD, JD-GUI, jadx, and others. smali2java is a decompiler based on the Smali code. They have their own shortcomings, such as the Java decompiler depends on the conversion of dex2jar. For complex, obfuscated or packed apks, there is a problem of translation failure. smali2java decompiles Smali code which should be translated from DEX with apktool, so it increases the difficulty and error rate and decreases the speed of manual analysis. In addition, their interaction is poor, which increases the difficulty of manual analysis. Although the commercial Jeb has better interactivity, it is easy to death when analyzing a large-sized APP with the Multidex, and it is very expensive for me… Changelog v4.0 Fix the bug that all nodes were deleted when searching the class tree Fix the bug that inheritance methods or members cannot cross-reference #91 Fix the problem that the parameters/return-value are not displayed during data flow analysis #91 Fix the problem about the python plug-in #92 The constant propagation algorithm is optimized to correct the error of code output #90 Optimize the expression output and correct several errors of code output #90 The variable declaration and expression are further optimized Fix some crash bugs. Add translation utility for strings (with Google and Youdao). [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.3.4 Features Support MethodParameters attribute (#1260) Plugin options: add verify checksum option for dex input (#1385), options for java-convert plugin [gui] Dialog for showing exception details and creating an GitHub issue (PR #1399) [gui] Add zoom in/out actions (#1403) Bug Fixes Improve class names collision detection (#1406) Allow implicit type cast for array operations (#1407) Allow zero skips for restore new filled array Load files also by extension (#1391) Prevent NPE on ‘ignore’ deobf map file mode [cli] Resolve regression in applying ‘-v’ and ‘-q’ options [debugger] Handle stream end and partial reads (#1412) [gui] Prevent NPE on open preferences without loaded files (#1385) [gui] IllegalArgumentException when saving project to a different directory than the APK file (#1387)(PR #1388) [gui] Initialize project name with loaded files (shown in Jadx title) (#1386)(PR #1393) [gui] Revert contextual keywords to identifiers (#1394) [gui] Handle package version in update check (#1397) [gui] Don’t use hardcoded color for link component (#1398) [gui] Download only latest version info for jadx update (#1397) [gui] Resolve NPE and fix code style in BreakpointManager [gui] Reduce threads count on low memory (#1410) [hide][Hidden Content]]

Reko (Swedish: “decent, obliging”) is a C# project containing a decompiler for machine code binaries. This project is freely available under the GNU General Public License. [hide][Hidden Content]]

Command-line and GUI tools for producing Java source code from Android Dex and Apk files Changelog v1.3.3 Features [gui] Add Frida snippet copy action (#1355)(PR #1356) [gui] Add Xposed snippet copy action (PR #1383) [gui] Ctrl+c copy highlighted word in code view (#1292) [gui] Ctrl+c copy node string in search window (#293) [cli] Improve single file mode (#1344)(#1384) [deobf] Do not deobfuscate known top-level domains with 2 or 3 characters (PR #1369) Add option for deobfuscation map filehandle mode (#1351) Support multi-entry loops (simple case) (#1320) Check dex checksum before parsing (#1343) Bug Fixes Support full class name in inner generic types (#1340) Correct use of class names for inner types (#1340) Update field usage on const replace (#1348) Don’t inline named variables (#1338) Prevent endless loop in path cross search (#1360) Prevent endless loop in anonymous class analysis (#1382) Check names from Kotlin metadata before use (#1364) Nested try catches with overlap try blocks (#1374)(PR #1375) Correct code reload after rename (#1378) Inline nested anonymous classes (#1379) Remove shadowed catch handlers (#1377) [cli] Fix and add debug log messages in initialization phase (PR #1362) [deobf] Collect missing renames for .jobf file (#1350)(PR #1353) [gui] Find usage for overridden methods (#1349)(PR #1352) [gui] Results in usage search sorted by name (PR #1363) [gui] Missing icons and html decorations in usage dialog [gui] Split decompile and index tasks for correct time counting (#1361) [res] Improved decoding of flag attributes in binary XML files (#1156)(PR #1359) [res] Skip ‘.9.png’ decode if patch data not found (#1112) Performance Improve ternary mod on big methods (#1379) [hide][Hidden Content]]

jadx – Dex to Java decompiler Command line and GUI tools for produce Java source code from Android Dex and Apk files Changelog v1.3.2 Core Use Kotlin intrinsic methods for variables rename (#1207) Improve anonymous class inline (#523) Correct literal negate for double and float (#1334) Add explicit type for non-int constants (#1336) Simplify cascading casts (#1336) Wrap negative literals before cast (#1327) Handle method override with several bases (#1234) Precalculate class deps for inline methods (#1339) Skip input file name checks by zip name validator (#1310) Use secure XML parser for process manifest GUI Processing threads spinner initialization (#1331)(PR #1332) Correct handling for tree row click (#1324) Reduce tree focus switching Use relative file paths in .jadx project file (#1312) (PR #1313) For Smali debugger: support multiple main <action> and <activity-alias> tags (#1322)(PR #1323) [hide][Hidden Content]]

Command line and GUI tools for produce Java source code from Android Dex and Apk files Changelog v1.3.1 Core Don’t unload field init values (#1277) Handle super case for invokespecial opcode (#1300) Improve try/catch bounds detection (#1303) Handle move-result after invoke-custom with string concat Use correct top block for try blocks with same start (#1304) Invoke in nested anonymous classes (#1305) Add merged condition blocks for loop region (#1307) Add option to use dx/d8 for convert java bytecode (#1299) Add comments with option references to improve usability GUI Smali code highlighting (PR #1283) Allow to minimize/maximize search windows (#1298) Update Quark report parsing (#1289) (PR #1291) Forward navigation shortcut on macOS (#1297)(PR #1301) Restore usage data after class reload (#1281) Include inlined classes in usage search (#1285) Add Traditional Chinese translation (PR #1306) Update Chinese translation (PR #1284, PR #1287, PR #1296) Update German translation (PR #1290) [hide][Hidden Content]]

Command line and GUI tools for produce Java source code from Android Dex and Apk files Changelog v1.3 Core Initial support for ‘invoke-custom’ instruction (#384) Initial support for java bytecode decompilation Concat constant strings (#1014) Rewrite try-catch processing Support AAR files as input (#1034) Support Android App Bundle (#1129) (PR #1131) Add option to change deobfuscation map file (#1117) Add option to disable methods inline (#1170) Improve decompilation speed (#1269) GUI Add a smali debugger (#1136) (PR #1137) Support code comments (#359) (PR #1127) Use FlatLaf for themes support Use SVG icons (PR #1221) Add Quark-Engine integration (#1119) (PR #1135) Allow to use regex in the search dialog (PR #1069) Search in resource files (#347) (#1032) (PR #1108) Improve exclude package feature (#1151) (PR #1152) Add option to change line numbers mode (#1223) Rename without deobfuscation, save renames in project (#1076 #1022) Save open tabs in project file Improve smali printer to show bytecode (#1114) (PR #1126) [hide][Hidden Content]]

GDA(GJoy Dex Analysizer) Most reverse engineers mainly use Java decompiler, commercial Dalvik decompiler Jeb, and smali2java to analyze Android APPs. Java decompiler is based on Java bytecode, including JD, JD-GUI, jadx, and others. smali2java is a decompiler based on the Smali code. They have their own shortcomings, such as the Java decompiler depends on the convert of dex2jar. For complex, obfuscated or packed apks, there is a problem of translation failure. smali2java decompiles Smali code which should be translated from DEX with apktool, so it increases the difficulty and error rate, and decreases the speed of manual analysis. In addition, their interaction is poor, which increases the difficulty of manual analysis. Although the commercial Jeb has better interactivity, it is easy to death when analyzing a large-sized APP with the Multidex, and it is very expensive for me… Changelog v3.97 A lot of novel optimizations and some updates have been added, and A lot of bugs have been fixed. In particular, the loading and analysis speed has been increased 3+ times faster than the old one. Double-clicking an interface method in an interface class, all implementations of the interface method will be displayed The memory limit is broken through and some problems caused by it is fixed Resource parsing and decompilation of resource classes are added The associated function of the permission module is disabled by default and can be enabled through the menu > View > PermissionRef The loading and parsing algorithms of classes, methods in the file are greatly optimized. DX tool is integrated into GDA. Optimizing the color configuration manager. Optimizing the Deobfuscation(much faster than the old) and fixing several bugs Loading analysis timeout prompt is added. The conversion of 64-bit integer data among with hexadecimal, hexadecimal, octal, character is added, and fix the problem that negative numbers cannot be converted correctly. The traversal algorithms of AllStrings and AppStringsare optimized to greatly improve the parsing speed. Add native methods and interfaces traversal function(pro). Optimize the display of callgraph of classes and methods. Resource file sensitive information detection is added to SensitiveInfo(pro). Optimize the search speed of string cross-reference. [hide][Hidden Content]]

Reko (Swedish: “decent, obliging”) is a C# project containing a decompiler for machine code binaries. This project is freely available under the GNU General Public License. Changelog v0.10.1 This maintenance release moves Reko from .NET Core 3.1 to .NET 5.0, resulting in some performance gains. It also fixes the MSI installers for Windows, which had several issues (including #1066 and #1067). Special thanks to @smx-smx for his work on his CI integration work. The Reko build system now assumes C# 9.0 Crude support for #define directives in the Reko C parser Overhaul of PA-RISC and HP SOM loader The command line driver --version switch displays the git hash used to build the binary. Improvements in AArch64 disassembler and rewriter (with @rfalke as a driving force) [hide][Hidden Content]]

GDA(GJoy Dex Analysizer) Most reverse engineers mainly use Java decompiler, commercial Dalvik decompiler Jeb, and smali2java to analyze Android APPs. Java decompiler is based on Java bytecode, including JD, JD-GUI, jadx, and others. smali2java is a decompiler based on the Smali code. They have their own shortcomings, such as the Java decompiler depends on the convert of dex2jar. For complex, obfuscated or packed apks, there is a problem of translation failure. smali2java decompiles Smali code which should be translated from DEX with apktool, so it increases the difficulty and error rate, and decreases the speed of manual analysis. In addition, their interaction is poor, which increases the difficulty of manual analysis. Although the commercial Jeb has better interactivity, it is easy to death when analyzing a large-sized APP with the Multidex, and it is very expensive for me… Changelog v3.96 Fix the memory call problem for Frida. Fix missing parentheses in multi-conditional expressions. #60 Fix the problem of inconsistent variable names caused by parent and child classes in different basic blocks. Add the saving of the js code for Frida when the device is not connected. The control flow analysis algorithm is further optimized. Implement the automatic propagation function of the overloaded method name renaming for the subclass of any class/interface. #65 [hide][Hidden Content]]

Reko (Swedish: "decent, obliging") is a decompiler for machine code binaries. This project is freely available under the GNU General Public License. The project consists of front ends, core decompiler engine, and back ends to help it achieve its goals. A command-line, a Windows GUI, and a ASP.NET front end exist at the time of writing. The decompiler engine receives inputs from the front ends in the form of either individual executable files or decompiler project files. Reko project files contain additional information about a binary file, helpful to the decompilation process or for formatting the output. The decompiler engine then proceeds to analyze the input binary. [hide][Hidden Content]]

Deep ghidra decompiler and sleigh disassembler integration for rizin This is an integration of the Ghidra decompiler and Sleigh Disassembler for rizin. It is solely based on the decompiler part of Ghidra, which is written entirely in C++, so Ghidra itself is not required at all and the plugin can be built self-contained. This project was presented, initially for radare2, at r2con 2019 as part of the Cutter talk: [Hidden Content] [hide][Hidden Content]]