nemerle/dcc

This is a heavily updated version of the old DOS executable decompiler DCC

dcc's Issues

Long signatures

I have read readsig.txt, and have found that currently, signatures are 23 bytes long. Is it true?
If so, is it possible to create signatures that will be longer? And, why is 23? How much signatures are missed in DCC because of this (and because of collisions)?

Any news?

Subj.

Consider marking Functions as 16/32 bit

Might allow for at least partial decompilation of mixed mode executables ?

DCC doesn't work on Turbo Pascal COM binaries

DCC includes signatures for Turbo Pascal 3.01 (which only generates MS-DOS COM binaries, not EXEs), however I have not been able to get it to work on even the simplest program.

Attached is a "Hello World" example. DCC either seems to use the wrong offset for the main() function, or if I fix that (to what I think it should be -- could still be wrong!), it always complains about 80386 instructions. Turbo Pascal 3.01 doesn't generate 80386 instructions, so that's clearly not right. It seems odd that DCC includes signatures for Turbo Pascal 3.01 (TP 3.00B and TP 3.02 generate a different signature and are not recognised by DCC, so I'm sure TP 3.01 is the correct version) and yet doesn't appear to work with TP 3.01 generated binaries at all!

Does anyone have any ideas?

TP301.zip

'and' operator in cpp code?

For example (icode.h):

bool matchWithRegDst(llIcode op)
{
    return (getOpcode()==op) and m_dst.isReg();
}

I cannot compile it. And there are many other operands too.

how to compile?

Hey,

Recently I wanted to compile this repository and it requires LLVM. However, when using llvm 3.6.2 it showed the following error when generating with CMake:

Boost version: 1.49.0
CMake Warning (dev) at c:/llvm/cmake/modules/LLVM-Config.cmake:56 (message):
  Using llvm_map_components_to_libraries() is deprecated.  Use
  llvm_map_components_to_libnames() instead
Call Stack (most recent call first):
  CMakeLists.txt:28 (llvm_map_components_to_libraries)
This warning is for project developers.  Use -Wno-dev to suppress it.

CMake Error at c:/llvm/cmake/modules/LLVM-Config.cmake:143 (message):
  Library `jit' not found in list of llvm libraries.
Call Stack (most recent call first):
  c:/llvm/cmake/modules/LLVM-Config.cmake:191 (llvm_map_components_to_libnames)
  c:/llvm/cmake/modules/LLVM-Config.cmake:57 (explicit_map_components_to_libraries)
  CMakeLists.txt:28 (llvm_map_components_to_libraries)


Configuring incomplete, errors occurred!
See also "C:/CodeBlocks/dcc/build/CMakeFiles/CMakeOutput.log".

Anyone have advice for me on how to handle this?

Build instruction

I was not able to find clear build instruction. The cmake, qt5, boost is required, right?
Please provide step by step build instruction for linux and win. As result I will able to help with development.

--output option doesn't work

Subj.

Teach dcc about another switch table idiom

  mov cx,NUM_CASES
  mov bx,JUMP_TABLE

LAB1:
  mov ax, [bx]
  cmp ax,VAL
  jz LAB2
  add bx,2
  loop LAB1
  jmp DEFAULT_CASE
LAB2
  jmp word ptr [bx+2*NUM_CASES]

What is the license of DCC?

Dear Friends,

Could you clarify me what is the license of DCC?
I would like to add DCC on FreeDOS
But we need to make sure DCC is opensource

Thank You Very Much/Kind Regards,
Geraldo Netto

dcc crashes at this executable

Subj.
PP219.zip

Function must return a value

Subj. These functions (dcc_interface.cpp):

ilFunction GetFirstFuncHandle()
{
}
ilFunction GetCurFuncHandle()
{
}
size_t getFuncCount()
{
}

Bad path for output name if subject has no path

If

./dcc_original subject.exe 

is run it will write a file "/subject.b" which is a rather bad location. On the other side:

./dcc_original ./subject.exe 

does the expected thing.

Dcc does not handle some forms of long detection

sub     dx, word ptr [bp+4]
sbb     ax, 0

Should be decoded as a unsigned cast of [bp+4] to a long variable. It isn't

Create dcc crash finder script (rb/py/sh?)

If dcc crashes on any function during decompilation it's hard to locate the offending function, and even harder to debug the whole state of decompiled executable.

Task:
create a script that given a FILENAME will:

• run dcc -a1 FILENAME
• extract all functions from produced FILENAME.a1
• extract function offsets from their names proc_001234_1 -> 0x1234
• for each function runs dcc -E FUNCTION_OFFSET FILENAME
• reports dcc crashes in a FILENAME_CRASHES.txt containing a full command-line to reproduce the crash

Instruction at location 0DAA9D goes beyond loaded image

GEMS_zip.zip
Subj. Also you need this: https://github.com/Nico01/dcc/blob/master/sig/dccbsig/dccb3l.sig

can't get this to build

I've tried with several different borland compilers in dosbox. can anyone provide a step-by-step guide on how to compile this?

makedsig - do not remove duplicates

When generating sig-file it will be better to use on of duplicated records instead of removing both of them.

Or, if it works that way already, allow to choose which of duplicates to use.

locident.h assert happens

Here:

const LONG_STKID_TYPE & longStkId() const {assert(isLong() and loc==STK_FRAME); return id.longStkId;}

PP219.EXE with -c flag.

Use of malloc.h

Some files (like pasehdr.cpp, makedsig.cpp and control.cpp) use the windows only malloc.h header file.
On UNIX-y Linux or Mac OS X, this header is non existent as malloc is normally defined in stdlib.h

I never understood why Microsoft have done that, but it would be nice to explicitely not try to add the malloc.h file if trying to compile on another system than Windows

A simple

#ifdef WIN32
#include <malloc.h>
#endif

should be enough

Using of non initialized variable _exp

https://github.com/nemerle/dcc/blob/qt5/src/dataflow.cpp#L1135 here.

if ( not _icHl.call.proc->hasRegArgs())
{
    fnc->processHliCall(_exp, picode.base());
}

Works at this file: PP219.zip

Add tools compiling to cmake list

Now it's only "makedsig".

Separate parsing and low level rewriting stages

Currently FollowCtrl will also rewrite some instructions ( DIV and XCHG ).

This should be separated into different 'Commands' that are ran sequentially.

Summary of your changes?

Can you please provide summary of changes you've done to dcc? In an accessible place, like README or other doc. I'd use commit log, but it's quality leaves much to be desired, e.g. LLVM headers were started to be included in 900438c, and the only commit message says is "from work".

Or perhaps the matter can be approached form another side - if I want to try decompilation of new code, how to produce binary file for input? I figure dcc doesn't suppport DOS .com files, which are easily to produce. I ended up installing openwatcom for .exe support, but dcc complains:

dcc: Don't understand 80386 instruction 63 at location 00014C

Even though openwatcom was told to produce 8086 code. Then I thought that maybe LLVM dependency allows to open ELF files, but that doesn't seem to be the case either...

libdisasm

There is a missing break, after this line:

dcc/3rd_party/libdisasm/ia32_modrm.cpp

Line 156 in f9b89c0

ia32_handle_register(&ea->index, REG_WORD_OFFSET + 7);

The bug is also in the original libdisasm since at least 15 year. It was probably not noticed because [bx+di] addressing mode was rarely used by compiler., none of the .exe test use it.

No patch provided as this repo seems inactive and anyway the patch is trivial but people who want to fork it need to care about that.

How to compile qt5 branch?

Im using CMake to make a VS 2015 solution, and I'm getting such error log:

CMake Warning at CMakeLists.txt:5 (find_package):
  By not providing "FindQt5Core.cmake" in CMAKE_MODULE_PATH this project has
  asked CMake to find a package configuration file provided by "Qt5Core", but
  CMake did not find one.

  Could not find a package configuration file provided by "Qt5Core" with any
  of the following names:

    Qt5CoreConfig.cmake
    qt5core-config.cmake

  Add the installation prefix of "Qt5Core" to CMAKE_PREFIX_PATH or set
  "Qt5Core_DIR" to a directory containing one of the above files.  If
  "Qt5Core" provides a separate development package or SDK, be sure it has
  been installed.


CMake Error at tools/makedsig/CMakeLists.txt:11 (qt5_use_modules):
  Unknown CMake command "qt5_use_modules".


CMake Error: The following variables are used in this project, but they are set to NOTFOUND.
Please set them or make sure they are set and tested correctly in the CMake files:
Boost_INCLUDE_DIR (ADVANCED)
   used as include directory in directory D:/git/dcc
   used as include directory in directory D:/git/dcc/3rd_party
   used as include directory in directory D:/git/dcc/3rd_party/libdisasm
   used as include directory in directory D:/git/dcc/3rd_party/libdisasm
   used as include directory in directory D:/git/dcc/3rd_party/libdisasm
   used as include directory in directory D:/git/dcc/common
   used as include directory in directory D:/git/dcc/common
   used as include directory in directory D:/git/dcc/tools
   used as include directory in directory D:/git/dcc/tools/makedsig
   used as include directory in directory D:/git/dcc/tools/makedsig