Skip to content
This repository was archived by the owner on Aug 23, 2022. It is now read-only.
This repository was archived by the owner on Aug 23, 2022. It is now read-only.

Decompiling Windows binaries (32bit and 64bit) does not work at all  #764

Open
@J1Man

Description

@J1Man

Hi Guys,

As the title says, I could not decompile any of the windows executables that I tried to bitcode using mcsema-lift-9.0. To see if I am doing anything wrong, I decided to try your Maze example by building binaries for Windows, but decompiling them did not work either. I wrote the details below.

I compiled the Maze example source code that is included in your repository to 32bit and 64bit Windows binaries using WinLibs Clang compiler on Windows 7. The compiler that I used is available at winlibs.com (release name: GCC 11.2.0 + LLVM/Clang/LLD/LLDB 12.0.1 + MinGW-w64 9.0.0 - release 1) . I attached the executables to this message as a zip file. I verified that the EXEs work well under windows.

I could not decompile them to BC bitcode files using mcsema-lift-9.0 on ubuntu linux. I got lots of OP code errors and other sorts of errors.

I am using a clean install Ubuntu 20.04.3 virtualmachine. I compiled Mcsema by following the instructions on your readme. I have IDA PRO 7.6 on my windows machine. I am able to generate CFG files from executables by using Mcsema's python scripts and IDA PRO 7.6.

Can you please take a look at the attached EXEs and see if you are able to convert them to bitcode on your end? Since none of the windows binaries that I tried work, I want to know if I am doing something wrong on my end.

On a separate note, I was able to decompile your example linux AARCH64 Maze binary and recompile it back. I generated the CFG on windows, created the BC on linux and recompiled it back as a amd64 linux executable on linux. I followed the instructions on your blog linked below. I want to mention that the recompiled amd64 linux maze binary sometimes (but not always) gave segfault errors while trying to solve the maze game.
https://blog.trailofbits.com/2018/01/23/heavy-lifting-with-mcsema-2-0/

Things just don't seem to work at all for 32bit/64bit windows executables.

MazeWindowsBinaries_32bitAnd64bit.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions