-
Notifications
You must be signed in to change notification settings - Fork 253
Does Reko support (processor|operating system|executable file format) $(FOO)
?
The current list of supported processors and file formats is here: Supported binaries. If you don't find support for $(FOO)
, open an issue in the Reko issue tracker! It's very helpful if you can provide one or more sample binaries for testing purposes.
I have a binary that has been packed with a [Packer] and Reko is failing to open it. Decompiler has an extensible architecture that supports adding unpacking scripts. If you need assistance with a specific unpacking script, create a Feature request and you will get assistance.
How do I decompile MS-DOS or COM files, or other executables that don't have an executable file structure? Reko will look for 'magic numbers' in the binary file you hand to it, to try to determine what kind of executable it is. However, some operating environments have simplistic binary formats. These usually involve reading the contents of the image file, which consists of machine code and data, but no metadata, into a particular well-known address in memory and then starting execution at that same address. Other times, all you have is a raw dump of executable code, with no metadata at all.
Because there is no executable header in such a file, Reko doesn't know what kind of machine code it is dealing with, not what operating environment the executable is expecting to be available. In these cases the operator needs to provide Reko with some assistance to get it started.
If you are using the GUI client, go to main menu and select File > Open As.... This gives you a dialog box where you can select the executable file you wish to decompile, the processor architecture to use when decompiling it, and the operating environment to use for system calls. Finally, specify the address at which the file contents should be loaded.
If you are using the command-line client, use the following incantation:
reko decompile --arch <processor> --env <O/S> --base <address> --entry <address> <filename>
Examples: if your executable is an MS-DOS COM file, use
reko decompile --arch x86-real-16 --env ms-dos --base 0C00:0100 foo.com
Notice that if you leave out the --entry
switch, Reko will use the --base
address as a starting point.
If your executable is a CP/M COM file, you would use
reko decompile --arch z80 --env cpm --base 0100 foo.com