Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is the Output of Retdec Compilable? #562

Closed
humanitiesclinic opened this issue Apr 30, 2019 · 10 comments
Closed

Is the Output of Retdec Compilable? #562

humanitiesclinic opened this issue Apr 30, 2019 · 10 comments

Comments

@humanitiesclinic
Copy link

I can decompile binaries successfully. Can I check if I can then compile the output from the decompiler? Is the output C or just C-like?

@humanitiesclinic
Copy link
Author

Ok I tried, with no success. Output:

Users-MacBook-Pro:retdec_output user$ gcc -o spray spray.c
spray.c:87:23: warning: implicit declaration of function '_getopt' is invalid in C99
      [-Wimplicit-function-declaration]
        int32_t v10 = _getopt((int32_t)a1, (char **)v6, (char *)v5); // 0x10000097c397416
                      ^
spray.c:104:35: warning: implicit declaration of function '_atoi' is invalid in C99
      [-Wimplicit-function-declaration]
                    int64_t v15 = _atoi((char *)*(int64_t *)v3); // 0x10000095d
                                  ^
spray.c:176:21: warning: implicit declaration of function '_clnt_create' is invalid in C99
      [-Wimplicit-function-declaration]
    int64_t * v25 = _clnt_create((char *)v24, 0x186ac, 1, "udp"); // 0x100000a06
                    ^
spray.c:176:15: warning: incompatible integer to pointer conversion initializing 'int64_t *'
      (aka 'long long *') with an expression of type 'int' [-Wint-conversion]
    int64_t * v25 = _clnt_create((char *)v24, 0x186ac, 1, "udp"); // 0x100000a06
              ^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
spray.c:179:9: warning: implicit declaration of function '_clnt_pcreateerror' is invalid in
      C99 [-Wimplicit-function-declaration]
        _clnt_pcreateerror((char *)a2);
        ^
spray.c:181:16: warning: incompatible pointer to integer conversion returning 'int32_t *'
      (aka 'int *') from a function with result type 'int64_t' (aka 'long long')
      [-Wint-conversion]
        return &g7;
               ^~~
spray.c:187:9: warning: implicit declaration of function '_printf' is invalid in C99
      [-Wimplicit-function-declaration]
        _printf("sending %d packets of lnth %d to %s ...", a1, v27, (char *)v26);
        ^
spray.c:188:9: warning: implicit declaration of function '_fflush' is invalid in C99
      [-Wimplicit-function-declaration]
        _fflush((struct _IO_FILE *)*(int64_t *)*(int64_t *)0x100001018);
        ^
spray.c:198:21: warning: implicit declaration of function '_usleep' is invalid in C99
      [-Wimplicit-function-declaration]
                    _usleep(v9);
                    ^
spray.c:217:28: warning: implicit declaration of function '__asm_cvtsi2sd' is invalid in C99
      [-Wimplicit-function-declaration]
            int128_t v34 = __asm_cvtsi2sd((int64_t)v33); // 0x100000b3a
                           ^
spray.c:220:28: warning: implicit declaration of function '__asm_addsd' is invalid in C99
      [-Wimplicit-function-declaration]
            int128_t v37 = __asm_addsd(__asm_divsd(v36, g1), v34); // 0x100000b4c
                           ^
spray.c:220:40: warning: implicit declaration of function '__asm_divsd' is invalid in C99
      [-Wimplicit-function-declaration]
            int128_t v37 = __asm_addsd(__asm_divsd(v36, g1), v34); // 0x100000b4c
                                       ^
spray.c:221:27: warning: implicit declaration of function '__asm_movsd' is invalid in C99
      [-Wimplicit-function-declaration]
            int64_t v38 = __asm_movsd(v37); // 0x100000b59
                          ^
spray.c:227:17: warning: implicit declaration of function '__asm_xorps' is invalid in C99
      [-Wimplicit-function-declaration]
                __asm_xorps(v37, v37);
                ^
spray.c:228:32: warning: implicit declaration of function '__asm_cvtsi2sd_1' is invalid in
      C99 [-Wimplicit-function-declaration]
                int128_t v41 = __asm_cvtsi2sd_1(v40); // 0x100000b96
                               ^
spray.c:229:32: warning: implicit declaration of function '__asm_mulsd' is invalid in C99
      [-Wimplicit-function-declaration]
                int128_t v42 = __asm_mulsd(v41, g2); // 0x100000b9a
                               ^
spray.c:232:94: warning: implicit declaration of function '__asm_divsd_2' is invalid in C99
      [-Wimplicit-function-declaration]
  ..._printf("\t%d packets (%.2f%%) dropped\n", (int64_t)v40, (float64_t)(int64_t)__asm_d...
                                                                                  ^
spray.c:235:17: warning: implicit declaration of function '_puts' is invalid in C99
      [-Wimplicit-function-declaration]
                _puts("\tno packets dropped");
                ^
spray.c:241:18: warning: implicit declaration of function '__asm_movsd_3' is invalid in C99
      [-Wimplicit-function-declaration]
            g8 = __asm_movsd_3(v44);
                 ^
spray.c:251:5: warning: implicit declaration of function '_clnt_perror' is invalid in C99
      [-Wimplicit-function-declaration]
    _clnt_perror(v25, (char *)a2);
    ^
spray.c:262:5: warning: implicit declaration of function '__asm_movapd' is invalid in C99
      [-Wimplicit-function-declaration]
    __asm_movapd(v2);
    ^
spray.c:265:5: warning: implicit declaration of function '__asm_ucomisd' is invalid in C99
      [-Wimplicit-function-declaration]
    __asm_ucomisd(v5, g3);
    ^
spray.c:279:5: warning: implicit declaration of function '_fwrite' is invalid in C99
      [-Wimplicit-function-declaration]
    _fwrite((int64_t *)"usage: spray [-c count] [-l length] [-d delay] host\n", 52, ...
    ^
spray.c:288:9: warning: implicit declaration of function '_xdr_u_int' is invalid in C99
      [-Wimplicit-function-declaration]
    if (_xdr_u_int((int64_t *)a1, (int32_t *)a2) == 0) {
        ^
spray.c:315:12: warning: implicit declaration of function '_xdr_bytes' is invalid in C99
      [-Wimplicit-function-declaration]
    return _xdr_bytes((int64_t *)a1, (char **)(a2 + 8), (int32_t *)a2, 0x228d) != 0;
           ^
spray.c:327:12: warning: incompatible integer to pointer conversion returning 'int' from a
      function with result type 'int64_t *' (aka 'long long *') [-Wint-conversion]
    return _clnt_create(host, prog, vers, prot);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
spray.c:399:12: warning: implicit declaration of function 'dyld_stub_binder' is invalid in
      C99 [-Wimplicit-function-declaration]
    return dyld_stub_binder();
           ^
27 warnings generated.
Undefined symbols for architecture x86_64:
  "___asm_addsd", referenced from:
      _entry_point in spray-4a3760.o
  "___asm_cvtsi2sd", referenced from:
      _entry_point in spray-4a3760.o
  "___asm_cvtsi2sd_1", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
  "___asm_divsd", referenced from:
      _entry_point in spray-4a3760.o
  "___asm_divsd_2", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
  "___asm_movapd", referenced from:
      _function_100000c1e in spray-4a3760.o
  "___asm_movsd", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
  "___asm_movsd_3", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
  "___asm_mulsd", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
  "___asm_ucomisd", referenced from:
      _function_100000c1e in spray-4a3760.o
  "___asm_xorps", referenced from:
      _entry_point in spray-4a3760.o
  "__atoi", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d4e in spray-4a3760.o
  "__clnt_create", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d54 in spray-4a3760.o
  "__clnt_pcreateerror", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d5a in spray-4a3760.o
  "__clnt_perror", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d60 in spray-4a3760.o
  "__fflush", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d6c in spray-4a3760.o
  "__fwrite", referenced from:
      _function_100000c8f in spray-4a3760.o
      _function_100000d72 in spray-4a3760.o
  "__getopt", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d78 in spray-4a3760.o
  "__printf", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
      _function_100000d7e in spray-4a3760.o
  "__puts", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000c1e in spray-4a3760.o
      _function_100000d84 in spray-4a3760.o
  "__usleep", referenced from:
      _entry_point in spray-4a3760.o
      _function_100000d8a in spray-4a3760.o
  "__xdr_bytes", referenced from:
      _function_100000d2b in spray-4a3760.o
      _function_100000d90 in spray-4a3760.o
  "__xdr_u_int", referenced from:
      _function_100000cbd in spray-4a3760.o
      _function_100000cf4 in spray-4a3760.o
      _function_100000d96 in spray-4a3760.o
  "_dyld_stub_binder", referenced from:
      _function_100000d9c in spray-4a3760.o
  "_main", referenced from:
     implicit entry/start for main executable
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)

@s3rvac
Copy link
Member

s3rvac commented Apr 30, 2019

Hi. This question has already been answered in #529, so please refer to it and to the discussion in #45.

@UnrealKaraulov
Copy link

UnrealKaraulov commented Dec 31, 2024

@s3rvac __asm_xorps is two unsigned 128bit operands, I got only 32bit signed in my output...

image

Missing data.

@greenozon
Copy link

@UnrealKaraulov not related to retdec, but might be interesting as well in your case - https://github.com/gaasedelen/microavx

@UnrealKaraulov
Copy link

@UnrealKaraulov not related to retdec, but might be interesting as well in your case - https://github.com/gaasedelen/microavx

but I use retdec and got this result, this is not retdec bug?

@greenozon
Copy link

seems yes..
do you have some sample binary to play with on this issue?

@UnrealKaraulov
Copy link

@greenozon yes but warning, binary contains RAT!

alt.zip
password infected

@UnrealKaraulov
Copy link

retdec processed xorps instructions as xorps 32bit,32bit instead of xorps 128bit,128bit

@greenozon
Copy link

yeah, seems IDA decompiles those AVX opcodes correctly, eg:
*v723 = _mm_xor_ps(*v723, v778);
etc..
so it operates on vars, not absolute numbers

@greenozon
Copy link

in my understanding the thing is that retdec does not have any translations for these kind of CPU opcodes, so it applies default behavior
eg:

{X86_INS_MOVAPS, nullptr},

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants