Warning

The RetDec project is currently in a limited maintenance mode due to a lack of resources: * Pull Requests are welcomed. They are reviewed with priority, if possible without delays. * Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a basic project maintenance. * The basic project maintenance continues. * Only a very limited development is carried on.

RetDec

RetDec is a retargetable machine-code decompiler based on LLVM.

The decompiler is not limited to any particular target architecture, operating system, or executable file format: * Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code * Supported architectures: * 32-bit: Intel x86, ARM, MIPS, PIC32, and PowerPC * 64-bit: x86-64, ARM64 (AArch64)

Features: * Static analysis of executable files with detailed information. * Compiler and packer detection. * Loading and instruction decoding. * Signature-based removal of statically linked library code. * Extraction and utilization of debugging information (DWARF, PDB). * Reconstruction of instruction idioms. * Detection and reconstruction of C++ class hierarchies (RTTI, vtables). * Demangling of symbols from C++ binaries (GCC, MSVC, Borland). * Reconstruction of functions, types, and high-level constructs. * Integrated disassembler. * Output in two high-level languages: C and a Python-like language. * Generation of call graphs, control-flow graphs, and various statistics.

For more information, check out our * Wiki (in progress) * Botconf 2017 talk: slides, video * REcon Montreal 2018 talk: slides * Publications

Installation

There are two ways of obtaining and installing RetDec: 1. Download and unpack a pre-built stable or bleeding-edge package and follow instructions in the Use section of its retdec/share/retdec/README.md file after unpacking. 2. Build RetDec by yourself from sources by following the Build and Installation section. After installation, follow instructions below.

We currently support Windows (7 or later), Linux, macOS, and (experimentally) FreeBSD. An installed version of RetDec requires approximately 5 to 6 GB of free disk space.

Use

Please, ensure that you reading instructions corresponding to the used RetDec version. If unsure, refer to the retdec/share/retdec/README.md file in the installation.

Windows

1. After installing RetDec, install Microsoft Visual C++ Redistributable for Visual Studio 2017.

2. Install the following programs:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

3. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR\bin\retdec-decompiler.exe test.exe

For more information, run retdec-decompiler.exe with --help.

Linux

1. After installing RetDec, install the following packages via your distribution's package manager:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe

For more information, run retdec-decompiler with --help.

macOS

1. After installing RetDec, install the following packages:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe

For more information, run retdec-decompiler with --help.

FreeBSD (Experimental)

1. There are currently no pre-built "ports" packages for FreeBSD. You will have to build and install the decompiler by yourself. The process is described below.

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe

For more information, run retdec-decompiler with --help.

Use of RetDec libraries

You can easily use various RetDec libraries in your projects - if they are build with CMake. RetDec installation contains all the necessary headers, libraries, and CMake scripts.

If you installed RetDec into a standard installation location of your system (e.g. /usr, /usr/local), all you need to do in order to use its components is:

find_package(retdec 5.0 REQUIRED
   COMPONENTS
      <component>
      [...]
)
target_link_libraries(your-project
   PUBLIC
      retdec::<component>
      [...]
)

If you did not install RetDec somewhere where it can be automatically discovered, you need to help CMake find it before find_package() is used. There are generally two ways to do it (pick & use only one):

1. Add the RetDec installation directory to CMAKE_PREFIX_PATH: cmake list(APPEND CMAKE_PREFIX_PATH ${RETDEC_INSTALL_DIR})

2. Set the path to installed RetDec CMake scripts to retdec_DIR: cmake set(retdec_DIR ${RETDEC_INSTALL_DIR}/share/retdec/cmake)

See the Repository Overview wiki page for the list of available RetDec components, or the retdec-build-system-tests for demos on how to use them.

Build and Installation

This section describes a local build and installation of RetDec. Instructions for Docker are given in the next section.

Requirements

Linux

• A C++ compiler and standard C++ library supporting C++17 (e.g. GCC >= 7)
• CMake (version >= 3.6)
• Git
• OpenSSL (version >= 1.1.1)
• Python (version >= 3.4)
• autotools (autoconf, automake, and libtool)
• pkg-config
• m4
• zlib
• Optional: Doxygen and Graphviz for generating API documentation

On Debian-based distributions (e.g. Ubuntu), the required packages can be installed with apt-get:

sudo apt-get install build-essential cmake git openssl libssl-dev python3 autoconf automake libtool pkg-config m4 zlib1g-dev upx doxygen graphviz

On RPM-based distributions (e.g. Fedora), the required packages can be installed with dnf:

sudo dnf install gcc gcc-c++ cmake make git openssl openssl-devel python3 autoconf automake libtool pkg-config m4 zlib-devel upx doxygen graphviz

On Arch Linux, the required packages can be installed with pacman:

sudo pacman --needed -S base-devel cmake git openssl python3 autoconf automake libtool pkg-config m4 zlib upx doxygen graphviz

Windows

• Microsoft Visual C++ (version >= Visual Studio 2017 version 15.7)
• CMake (version >= 3.6)
• Git
• OpenSSL (version >= 1.1.1)
• Python (version >= 3.4)
• Optional: Doxygen and Graphviz for generating API documentation

macOS

Packages should be preferably installed via Homebrew.

• macOS >= 10.15
• Full Xcode installation (including command-line tools, see #425 and #433)
• CMake (version >= 3.6)
• Git
• OpenSSL (version >= 1.1.1)
• Python (version >= 3.4)
• autotools (autoconf, automake, and libtool)
• Optional: Doxygen and Graphviz for generating API documentation

FreeBSD (Experimental)

Packages should be installed via FreeBSDs pre-compiled package repository using the pkg command or built from scratch using the ports database method.

• Full "pkg" tool instructions: handbook pkg method
• pkg install cmake python37 git autotools OR
• Full "ports" instructions: handbook ports method
• portsnap fetch
• portsnap extract
• For example, cmake would be
• whereis cmake
• cd /usr/ports/devel/cmake
• make install clean

Process

Note: Although RetDec now supports a system-wide installation (#94), unless you use your distribution's package manager to install it, we recommend installing RetDec locally into a designated directory. The reason for this is that uninstallation will be easier as you will only need to remove a single directory. To perform a local installation, run cmake with the -DCMAKE_INSTALL_PREFIX=<path> parameter, where <path> is directory into which RetDec will be installed (e.g. $HOME/projects/retdec-install on Linux and macOS, and C:\projects\retdec-install on Windows).

• Clone the repository:
• git clone https://github.com/avast/retdec
• Linux:
• cd retdec
• mkdir build && cd build
• cmake .. -DCMAKE_INSTALL_PREFIX=<path>
• make -jN (N is the number of processes to use for parallel build, typically number of cores + 1 gives fastest compilation time)
• make install
• Windows:
• Open a command prompt (e.g. cmd.exe)
• cd retdec
• mkdir build && cd build
• cmake .. -DCMAKE_INSTALL_PREFIX=<path> -G<generator>
• cmake --build . --config Release -- -m
• cmake --build . --config Release --target install
• Alternatively, you can open retdec.sln generated by cmake in Visual Studio IDE
• macOS:
• cd retdec
• mkdir build && cd build
• cmake .. -DCMAKE_INSTALL_PREFIX=<path>
• make -jN (N is the number of processes to use for parallel build, typically number of cores + 1 gives fastest compilation time)
• make install
• FreeBSD:
• sudo pkg install git cmake
• git clone https://github.com/avast/retdec
• cd retdec
• mkdir build && cd build
• sh # FreeBSD (and other BSDs) do need cmake, python3, git, autotools. OpenSSL is pre-installed in the OS but check its version. # Later versions may be available for each of the packages. # See what is installed: sudo pkg info cmake python37 autotools # Install/upgrade them: sudo pkg install cmake python37 autotools
• cmake .. -DCMAKE_INSTALL_PREFIX=<path>
• make -jN (N is the number of processes to use for parallel build, typically number of cores + 1 gives fastest compilation time)
• make install

You have to pass the following parameters to cmake: * -DCMAKE_INSTALL_PREFIX=<path> to set the installation path to <path>. Quote the path if you are using backslashes on Windows (e.g. -DCMAKE_INSTALL_PREFIX="C:\retdec"). * (Windows only) -G<generator> is -G"Visual Studio 15 2017" for 32-bit build using Visual Studio 2017, or -G"Visual Studio 15 2017 Win64" for 64-bit build using Visual Studio 2017. Later versions of Visual Studio may be used.

You can pass the following additional parameters to cmake: * -DRETDEC_DOC=ON to build with API documentation (requires Doxygen and Graphviz, disabled by default). * -DRETDEC_TESTS=ON to build with tests (disabled by default). * -DRETDEC_DEV_TOOLS=ON to build with development tools (disabled by default). * -DRETDEC_COMPILE_YARA=OFF to disable YARA rules compilation at installation step (enabled by default). * -DCMAKE_BUILD_TYPE=Debug to build with debugging information, which is useful during development. By default, the project is built in the Release mode. This has no effect on Windows, but the same thing can be achieved by running cmake --build . with the --config Debug parameter. * -D<dep>_LOCAL_DIR=<path> where <dep> is from `{CAPSTONE, GOOGLETEST, KEYSTONE, LLVM