We’re excited to release the DotNET Decompiler package for all licenses of Cerbero Suite: this package is capable of decompiling .NET assemblies from their bytecode back to C#.
Once you have installed the package, you can access the decompiler from the bytecode view.
We’re excited to release the DEX Decompiler package for all licenses of Cerbero Suite: this package is capable of decompiling Android DEX files from their bytecode back to Java.
Once you have installed the package, you can access the decompiler from the bytecode view.
We’re excited to release the Java Decompiler package for all licenses of Cerbero Suite: this package is capable of decompiling Java Class files from their bytecode back to Java.
Once you have installed the package, you can access the decompiler from the bytecode view.
The bytecode view and the decompiler are accessible not only within Java Class files but also within JAR files.
In the upcoming Cerbero Suite 5.2 we used our new multi-processing technology (part 1, part 2) to parallelize the Sleigh decompiler by running it in a different process. This guarantees complete stability in case Sleigh encounters an issue and makes every decompiling operation safe to cancel.
We didn’t notice slow-downs by running the decompiler in a different process, in fact it’s still blazingly fast.
By parallelizing the decompiler we were also able to initialize it during the loading of the file / database. Thus, when the decompiler is invoked for the first time there is no initial delay.
Although the decompiler doesn’t take much time to load, the preloading makes it extra-snappy.
It is also possible to choose to run the decompiler in the same process as before from the Carbon settings.
The upcoming 5.1 version of Cerbero Suite Advanced introduces improvements in the output of the decompiler.
One of the improvements is the detection and display of indirect string literal references. These type of references are already correctly handled by our ultra-fast Carbon disassembler.
Let’s take for instance the following code example:
#include <stdio.h>
void foo(const char **ref)
{
puts(*ref);
}
int main ()
{
static const char *s = "Referenced string";
foo(&s);
return 0;
}
Our Carbon disassembler already detects the indirect reference:
RefString:.text:0x140001000 sub_140001000 proc start
RefString:.text:0x140001000 ; CODE XREF: 0x14000128E
RefString:.text:0x140001000 ; DATA XREF: 0x140004000
RefString:.text:0x140001000 ; unwind {
RefString:.text:0x140001000 sub rsp, 0x28
RefString:.text:0x140001004 mov rcx, qword ptr [0x140003020] ; ptr:"Referenced string"
RefString:.text:0x14000100B call qword ptr [0x140002118] -> puts
RefString:.text:0x140001011 xor eax, eax
RefString:.text:0x140001013 add rsp, 0x28
RefString:.text:0x140001017 ret
RefString:.text:0x140001017 ; } // starts at sub_140001000
RefString:.text:0x140001017
RefString:.text:0x140001017 sub_140001000 proc end
However, up until now the decompiler would produce the following output:
undefined64 __fastcall sub_140001000(void)
{
(*_puts)(*(undefined64 *)0x140003020);
return 0;
}
While, in the upcoming version the output is:
undefined64 __fastcall sub_140001000(void)
{
(*_puts)(*(undefined64 *)&"Referenced string");
return 0;
}
More decompiler improvements will be introduced in the upcoming version!
We’re happy to announce the release of Cerbero Suite 3.5!
This is a single feature release: it includes integration of the Ghidra decompiler (Sleigh) in our Carbon disassembler. No Ghidra or Java installation is necessary!
The decompiler features navigation, comments and renaming of functions, labels and variables.
If you like the idea, we can further expand the functionality and improve the output in next releases!
Happy hacking!