A decompiler project where you arrange on a magic corkboard

About Cork


Goals?

This is a jam project hopefully working to improve on the ideas of Ghidra or IDA without the cruft and a smarter and more malleable interface. Some of the planned improvements were the ability to modify the C code with the application of structured macros (they would look like normal C macros but be made up of special AST nodes) such that you could keep the semantics without having to see everything at once.

What ended up happening?

I only got through the basics of writing a decompiler with some variable renaming and no function call analysis or macros stuff... :v(

I'm ok with this though, i've learned quite a bit and have decided I want to develop this project further and the jam gave me a good excuse to think and try new things.

Capture.PNG

Capture.PNG

What did I learn?

I learned a few analysis techniques for decompilation and optimizers (there's a degree of overlap between the fields) mostly to do with detecting common code patterns such as if statements using dominance analysis and using SROA (scalar replacement of aggregates, an optimization to split structs and other aggregates into separate pieces to analyze better) to identify stack variables in the decompilation process.

Continuing...

When I continue this project i hope to refactor the framework for converting functions into IR (needs a proper type system), I also wish to expose an assembly view of the program since that's still helpful even if you use the C-view mostly. It's also important that I implement the deduction tools such as being able to mark certain dynamic function calls as potentially referring to a specific group of functions or being able to filter by compatible types in during manual retyping.

Wanna try?

Download & extract

Drag-n-drop the object files (most machine code doesn't work yet and exes can in theory but i didn't get around to testing it much) into the open window.

press Ctrl+C to copy decompiled contents outside of the viewer. press R to initiate rename (doesn't work on parameter)

Read more
Filters

Recent Activity

&cork started work on functions calls, ideally i can do retyping tommorow so that my display of arrays isn't incorrect

View original message on Discord

&cork Got my first function converted over using my Decompiler, it's slightly broken but almost there

View original message on Discord

&cork I've made TB bindings for Odin using Cuik to handle the automated labor with me filling in for the limits of it. I'll be needing it for the code analysis stuff that i'll be doing.

View original message on Discord