search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.62k stars 5.78k forks source link

Is it possible to decompile any file and generate its true code? #1173

Closed JafferWilson closed 4 years ago

JafferWilson commented 4 years ago

Hello developer, I am really delighted to see this repository. It is wonderful tool as per demos I saw. I have tried something I will share. I try to open an .ex5 file which is a Metatrader 5 file. I saw the binary level code and even try to check if I could decompile it and get the source out of it or even the traces of the source. I was not able to do so with this wonderful tool, which had helped me in viewing different tools. But I am amazed to witness that it was not at all helpful to me there. Please developer can you tell whether I can get the de-compilation and traces of the source of any .ex5 file. If needed I will share one with you so that you can check. Please do let me know your suggestions.

ryanmkurtz commented 4 years ago

Ghidra does not support the .ex5 file format. A custom Ghidra Loader would have to be written to handle it.

JafferWilson commented 4 years ago

@ryanmkurtz That would be an awesome solution. But I wonder whether it is feasible to decode ex5 or not?

ryanmkurtz commented 4 years ago

We are not familiar with that format, so it's hard to say. Ghidra needs a loader to bring in the file and lay it out in memory, and then a processor/language module to decode the instructions. Do you know what processor these files are meant to run under? x86?

JafferWilson commented 4 years ago

Yes x86. I am using on my PC. It is compiled using MQL5 language. It is I guess customized c++ language compiler or something. I am not able to understand it.

ryanmkurtz commented 4 years ago

The file might be compressed or something...that's where the loader would come in.

JafferWilson commented 4 years ago

Yes, you are right. You need terminal.exe for loading the ex5.

ryanmkurtz commented 4 years ago

I am going to go ahead and close this ticket, as this proprietary file format it outside of the Ghidra team's scope.

JafferWilson commented 4 years ago

@ryanmkurtz But can you suggest me something that will help me analyze this ex5,please?

ryanmkurtz commented 4 years ago

I know of nothing, sorry!

pargara commented 2 years ago

@JafferWilson Did you find a way to decompile it?

Twapa commented 2 years ago

yes

pargara commented 2 years ago

yes

How?

JoaojpAxx commented 2 days ago

Cadê a resposta chefe ??