convert executable back to C source code

Question

Unfortunately I lost my source code and I just have the output file that made with gcc in linux and I don’t have any access to my pc now.is there any way to convert output file to source file (in c under linux)?

Answer 1

So you had a cow, but you inadvertently converted it to hamburger, and now you want your cow back.

Sorry, it just doesn't work that way.

Simply restore the source file from your backups.

Ah, you didn't have backups. Unfortunately, the universe doens't give you a break for that.

You can decompile the binary. That won't give you your source code, but it'll give you some source code with the same behavior. You won't get the variable names unless it was a debug binary. You won't get the exact same logic unless you compiled without optimizations. Obviously, you won't get comments.

I've used Boomerang to decompile some programs, and the result was more readable than the machine code. I don't know if it's the best tool out there. Anyway, don't expect miracles.

Answer 2

Several tools are common in reverse engineering an executable.

1. The command "file" which takes the file path as the first parameter so you can determine (in most cases) what type of executable you have.
2. Disassemblers which show EXACTLY what the executable does but is difficult to read for those that don't write assembly code on that specific architecture or have experience with disassembly.
3. Decompilers like Boomerang, Hex-rays, and Snowman can provide some greater readability but they do not recover the actual variable names or syntax of the original program and they are not 100% reliable, especially in cases where the engineers that created the executable tested with these packages and tried to obfuscate the security further.
4. Data flow diagrams or tables. I know of no free tool to do this automatically, but a Python or Bash script over the top of a text parser of the assembly output (which can be written in sed or Perl) can be helpful.
5. Pencil and paper, believe it or not, for jotting flows and ideas.

In most cases I've seen, the code needed to be rewritten from scratch, maintained as an assembly language program, or reconstituted by re-applying change requests to an older version.

Answer 3

What you want to do is called "decompiling". There are many decompilers out there and it's not practical to cover them all here.

However, as a general remark: The conversion from C source to executable machine code is lossy. For instance:

• Comments are irreversibly lost
• Variable names are gone
• Sometimes loops are unrolled for performance
• Functions may be rearranged

It is rare for code to be compiled as written. Most compilers these days will drastically change your code to optimize it. So when you decompile, the compiler can only guess at what the source code must have looked like, it has no way of knowing what your code was, because that's gone. If the decompiler is good, the code you get will at least be compilable back into an equivalent executable, and then you can start slowly refactoring it to be readable. But most likely the decompiler will produce absolutely unreadable spaghetti code, and it will be a huge headache to decipher it. Sometimes, it might end up being less work to just re-write the program from scratch.