Posts

Showing posts from December, 2012

Decompiling Delphi - 3

I came across this on delphi.about.com web site and thought it useful to add it a a reference here. continued from part two The art of reverse engineering has traditionally been the land of technical wizards, familiar with assembly language and debuggers. Several Delphi decompilers have appeared that allow anybody, even with limited technical knowledge, to reverse engineer most Delphi executable files. If you are interested in reverse engineering Delphi programs I suggest you to take a look at the following few "decompilers": IDR (Interactive Delphi Reconstructor) A decompiler of executable files (EXE) and dynamic libraries (DLL), written in Delphi and executed in Windows32 environment. Final project goal is development of the program capable to restore the most part of initial Delphi source codes from the compiled file but IDR, as well as others Delphi decompilers, cannot do it yet. Nevertheless, IDR is in a status considerably to facilitate such process. In co...

Decompiling Delphi - 2

I came across this on delphi.about.com web site and thought it useful to add it a a reference here. continued from part one For the moment, Borland does not offer any product capable of decompiling an executable (.exe) file or the "Delphi compiled unit" (.dcu) back to the original source code (.pas). Delphi compiled unit: DCU When a Delphi project is compiled or run a compiled unit (.pas) file is created. By default the compiled version of each unit is stored in a separate binary-format file with the same name as the unit file, but with the extension .DCU. For example unit1.dcu contains the code and data declared in the unit1.pas file. This means that if you have someones, for example, component compiled source all you have to do is to reverse it and get the code. Wrong. The DCU file format is undocumented (proprietary format) and may change from version to version. After the compiler: Delphi Reverse Engineering If you would like to try to decompile a Delphi e...

Decompiling Delphi - 1

I came across this on delphi.about.com web site and thought it useful to add it a a reference here. Decompilation? Reverse? Cracking?` Simply speaking, decompilation is the inverse of compilation: translating an executable file into a higher level language. Suppose you lose your Delphi project's source and you only have the executable file: reverse engineering (decompilation) is useful if the original sources are not available. Hm, "sources not available", does this mean that we can decompile other people's Delphi projects? Well, yes and no.. Is true decompilation possible? No, of course not. Fully automated decompilation is not possible - no decompiler could exactly reproduce the original source code. When a Delphi project is compiled and linked to produce a standalone executable file, most of the names used in the program are converted to addresses. This loss of names means that a decompiler would have to create unique names for all the constants, variab...