Warning

The RetDec project is currently in a limited maintenance mode due to a lack of resources:

• Pull Requests are welcomed. They are reviewed with priority, if possible without delays.
• Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a basic project maintenance.
• The basic project maintenance continues.
• Only a very limited development is carried on.

RetDec

))/statusIcon)

RetDec is a retargetable machine-code decompiler based on LLVM.

The decompiler is not limited to any particular target architecture, operating system, or executable file format:

• Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code
• Supported architectures:
  • 32-bit: Intel x86, ARM, MIPS, PIC32, and PowerPC
  • 64-bit: x86-64, ARM64 (AArch64)

Features:

• Static analysis of executable files with detailed information.
• Compiler and packer detection.
• Loading and instruction decoding.
• Signature-based removal of statically linked library code.
• Extraction and utilization of debugging information (DWARF, PDB).
• Reconstruction of instruction idioms.
• Detection and reconstruction of C++ class hierarchies (RTTI, vtables).
• Demangling of symbols from C++ binaries (GCC, MSVC, Borland).
• Reconstruction of functions, types, and high-level constructs.
• Integrated disassembler.
• Output in two high-level languages: C and a Python-like language.
• Generation of call graphs, control-flow graphs, and various statistics.

For more information, check out our

• Wiki (in progress)
• Botconf 2017 talk: slides, video
• REcon Montreal 2018 talk: slides
• Publications

Installation

There are two ways of obtaining and installing RetDec:

1. Download and unpack a pre-built stable or bleeding-edge package and follow instructions in the Use section of its retdec/share/retdec/README.md file after unpacking.
2. Build RetDec by yourself from sources by following the Build and Installation section. After installation, follow instructions below.

We currently support Windows (7 or later), Linux, macOS, and (experimentally) FreeBSD. An installed version of RetDec requires approximately 5 to 6 GB of free disk space.

Use

Please, ensure that you reading instructions corresponding to the used RetDec version. If unsure, refer to the retdec/share/retdec/README.md file in the installation.

Windows

1. After installing RetDec, install Microsoft Visual C++ Redistributable for Visual Studio 2017.

2. Install the following programs:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

3. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR\bin\retdec-decompiler.exe test.exe
   

   For more information, run retdec-decompiler.exe with --help.

Linux

1. After installing RetDec, install the following packages via your distribution's package manager:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe
   

   For more information, run retdec-decompiler with --help.

macOS

1. After installing RetDec, install the following packages:

   • UPX (Optional: if you want to use UPX unpacker in the preprocessing stage)
   • Graphviz (Optional: if you want to generate call or control flow graphs)

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe
   

   For more information, run retdec-decompiler with --help.

FreeBSD (Experimental)

1. There are currently no pre-built "ports" packages for FreeBSD. You will have to build and install the decompiler by yourself. The process is described below.

2. To decompile a binary file named test.exe, run

   $RETDEC_INSTALL_DIR/bin/retdec-decompiler test.exe
   

   For more information, run retdec-decompiler with --help.

Use of RetDec libraries

You can easily use various RetDec libraries in your projects - if they are build with CMake. RetDec installation contains all the necessary headers, libraries, and CMake scripts.

If you installed RetDec into a standard installation location of your system (e.g. /usr, /usr/local), all you need to do in order to use its components is:

find_package(retdec 5.0 REQUIRED
   COMPONENTS
      <component>
      [...]
)
target_link_libraries(your-project
   PUBLIC
      retdec::<component>
      [...]
)

If you did not install RetDec somewhere where it can be automatically discovered, you need to help CMake find it before find_package() is used. There are generally two ways to do it (pick & use only one):

1. Add the RetDec installation directory to CMAKE_PREFIX_PATH:

   list(APPEND CMAKE_PREFIX_PATH ${RETDEC_INSTALL_DIR})
   

2. Set the path to installed RetDec CMake scripts to retdec_DIR:

   set(retdec_DIR ${RETDEC_INSTALL_DIR}/share/retdec/cmake)
   

See the Repository Overview wiki page for the list of available RetDec components, or the retdec-build-system-tests for demos on how to use them.

Build and Installation

This section describes a local build and installation of RetDec. Instructions for Docker are given in the next section.

Requirements

Linux

• A C++ compiler and standard C++ library supporting C++17 (e.g. GCC >= 7)
• CMake (version >= 3.6)
• Git
• OpenSSL (version >= 1.1.1)
• Python (version >= 3.4)
• autotools (autoconf, automake, and libtool)
• pkg-config
• m4
• zlib
• Optional: Doxygen and Graphviz for generating API documentation

On Debian-based distributions (e.g. Ubuntu), the required packages can be installed with apt-get: