Source Code Recovery

* Quick note: in proper conditions it's also possible to recover source code in other programming language than the software was written in

How is source code recovery done?

Source code recovery isn't an easy task and takes time, specialized tools and reverse engineering skills.

First of all, software has to be analyzed to determine the compiler and the programming language it was written in. At this stage I know what libraries were used, what technologies has been involved (like database drivers, graphical libraries etc.).

Another step is software disassembling and decompilation (if possible). At this point I know what the compiled code looks like and the work can continue. With the proper knowledge of code structure, reverse engineering and programming, each function is analyzed and its binary code is translated by hand or by the decompiler to the desired output high level programming language.

Source code recovery example

Here is the sample C++ output code in x86 assembler :

Compiled code. Simple function, disassembled to x86 code

.text:00401000 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:00401000 _main	proc near		; CODE XREF: ___tmainCRTStartup+F8p
.text:00401000		push	40h		; uType
.text:00401002		push	offset Caption  ; "Hi!"
.text:00401007		push	offset Text	; "Hello World!"
.text:0040100C		push	0		; hWnd
.text:0040100E		call	ds:MessageBoxW
.text:00401014		xor	eax, eax
.text:00401016		retn
.text:00401016 _main	endp

Restored source. C++ code from the x86 output

int __cdecl main(int argc, char *argv[], char *envp[])
{
	MessageBox(NULL, L"Hello World!", L"Hi!", MB_ICONINFORMATION);

	return 0;
}

This is only a simple example, in real life and real world applications everything is more complex.

What can be recovered?

Source code recovery is tedious work and can take as much time as one day, but in some cases it can take even a few months, depending on the project size and its complexity. So what can be recovered?

• entire code base
• application resources (files, images, databases) from encrypted or compressed containers
• specific functions and algorithms
• encryption and compression algorithms
• encryption keys
• login passwords (for databases connections etc.)